Knowledge + Practice

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 601–675

1621 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 9 of 22

601

Multi-Selecteasy

Which TWO encryption methods for data at rest in Amazon S3 use AWS-managed or customer-managed keys? (Choose TWO.)

Select 2 answers

A.SSE-C

B.Client-Side Encryption

C.SSL/TLS

D.SSE-S3

E.SSE-KMS

AnswersD, E

SSE-S3 uses AWS-managed keys to encrypt data at rest.

Why this answer

SSE-S3 uses AWS-managed keys, and SSE-KMS uses customer-managed keys via AWS KMS. Both are valid methods to encrypt data at rest in Amazon S3. SSE-C uses customer-provided keys, which is not a managed key service.

Client-side encryption is performed by the client before upload and does not use AWS-managed or customer-managed keys. SSL/TLS encrypts data in transit, not at rest.

Full explanation →

602

MCQhard

A company has a hybrid network with multiple VPCs connected via AWS Transit Gateway and an on-premises network via Direct Connect. The network team is planning to migrate a legacy application from on-premises to a new VPC. The application requires low-latency access to an RDS database running in an existing VPC. The team wants to minimize changes to the existing routing. What should the team do to meet these requirements?

A.Attach the new VPC to the existing transit gateway and ensure the transit gateway route tables permit traffic between the new VPC and the RDS VPC.

B.Set up a VPN connection from the new VPC to the on-premises network, and route traffic through on-premises to the RDS VPC.

C.Create a VPC peering connection between the new VPC and the RDS VPC.

D.Migrate the RDS database to the new VPC to keep the application and database in the same VPC.

AnswerA

Correct: Leveraging existing transit gateway minimizes routing changes.

Why this answer

Attaching the new VPC to the existing transit gateway allows immediate connectivity to the RDS VPC without changing existing routes, provided the transit gateway route tables are configured correctly. Option B is wrong because routing traffic through on-premises adds unnecessary latency and complexity. Option C is wrong because VPC peering requires route table updates in both VPCs, which contradicts the requirement to minimize routing changes.

Option D is wrong because migrating the RDS database would change the database endpoint and potentially cause downtime, and does not leverage the existing transit gateway.

Full explanation →

603

MCQmedium

A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Direct Connect private VIF. The VPC has a virtual private gateway attached. The on-premises router can ping the private IP of an EC2 instance in the VPC, but application traffic (TCP port 443) fails. What is the most likely cause?

A.The network ACL in the VPC is blocking outbound traffic.

B.The security group for the EC2 instance does not allow inbound HTTPS traffic.

C.The BGP session is in the 'Idle' state.

D.The route table associated with the virtual private gateway does not have a route to the on-premises network.

AnswerB

Security groups are stateful, so outbound return traffic is allowed automatically. The inbound rule for HTTPS must be present.

Why this answer

Since the on-premises router can ping the EC2 instance's private IP, Layer 3 connectivity is working, which rules out routing and BGP issues. The failure of TCP port 443 specifically points to a firewall or access control blocking the application traffic. A security group acts as a virtual firewall at the instance level, and by default it denies all inbound traffic unless explicitly allowed.

Therefore, the most likely cause is that the security group for the EC2 instance does not have an inbound rule permitting HTTPS (TCP 443) traffic.

Exam trap

The trap here is that candidates assume ping success implies full application-layer connectivity, but security groups can selectively block specific protocols or ports while allowing ICMP, leading to a false sense of network health.

How to eliminate wrong answers

Option A is wrong because a network ACL is stateless and operates at the subnet level; if outbound traffic were blocked, the ping reply (ICMP) would also fail, but ping succeeds, so this is not the issue. Option C is wrong because if the BGP session were in the 'Idle' state, the virtual private gateway would not have learned the on-premises routes, making Layer 3 connectivity impossible and ping would fail. Option D is wrong because if the route table associated with the virtual private gateway lacked a route to the on-premises network, return traffic from the VPC would not be forwarded, and ping replies would not reach the on-premises router, yet ping succeeds.

Full explanation →

604

MCQhard

A company has a global application deployed across multiple AWS Regions. The application uses Amazon Route 53 latency-based routing. The network team wants to monitor the health of the application endpoints. They configure Route 53 health checks with fast interval (10 seconds) for each endpoint. After a few days, they notice an increase in costs. Which change will reduce costs while maintaining adequate health monitoring?

A.Disable health checks and rely on Route 53 latency measurements.

B.Change the health check interval to standard (30 seconds).

C.Use CloudWatch alarms instead of Route 53 health checks.

D.Remove health checks for endpoints that are in the same Region.

AnswerB

Standard interval reduces frequency and cost, still adequate for latency-based routing.

Why this answer

Health checks are billed per check. Using a slower interval reduces the number of checks. Standard interval (30 seconds) is sufficient for most cases.

Disabling end-to-end health checks or removing health checks would reduce functionality. Using CloudWatch alarms is additional cost.

Full explanation →

605

MCQmedium

A company is designing a multi-region architecture using AWS Transit Gateway inter-region peering. They need to ensure that traffic between VPCs in different regions can traverse the TGW peering attachment without being inspected by a central security appliance. Which configuration should be used?

A.Create TGW peering attachments and configure the route tables to point to each other's TGW attachment.

B.Route all inter-region traffic through a centralized inspection VPC in one region.

C.Set up a VPN connection between the two TGWs for encrypted traffic.

D.Use VPC peering between the VPCs instead of TGW peering.

AnswerA

This allows direct traffic flow between TGWs, bypassing inspection.

Why this answer

TGW peering attachments allow traffic to bypass the central inspection VPC if routing is set up to go directly between TGWs. Option B is wrong because it forces inspection. Option C is wrong because VPN is not needed.

Option D is wrong because VPC peering does not support transitive routing via TGW.

Full explanation →

606

Multi-Selecthard

Which TWO scenarios are best suited for using AWS Transit Gateway over VPC peering? (Select TWO.)

Select 2 answers

A.Connecting VPCs in different AWS accounts

B.Connecting a single VPC to an on-premises network

C.Connecting hundreds of VPCs across multiple accounts

D.Connecting VPCs to on-premises via Direct Connect

E.Connecting two VPCs in the same account and region

AnswersC, D

Transit Gateway simplifies hub-and-spoke topology.

Why this answer

AWS Transit Gateway is designed to act as a central hub for connecting multiple VPCs and on-premises networks, simplifying management and reducing the number of connections. Option C is correct because Transit Gateway can scale to connect hundreds of VPCs across multiple accounts using a hub-and-spoke model, whereas VPC peering would require a full mesh of point-to-point connections, which becomes unmanageable and hits the hard limit of 125 peering connections per VPC. Option D is correct because Transit Gateway natively integrates with AWS Direct Connect via a Direct Connect Gateway, allowing a single Transit Gateway to route traffic from multiple VPCs to on-premises without needing individual VPN tunnels or complex routing configurations.

Exam trap

The trap here is that candidates assume VPC peering is always simpler for cross-account or on-premises connections, but the exam tests the scalability and management overhead differences, especially when the number of VPCs exceeds a handful or when transitive routing is required.

Full explanation →

607

MCQhard

A company has a global application deployed across multiple AWS Regions. They use an Amazon Route 53 latency-based routing policy to direct users to the closest region. Recently, users in Asia are experiencing high latency even though traffic is being directed to the nearest region. The network team reviews the latency measurements and notices that the Route 53 latency values are based on the region where the resources are hosted, but the actual application performance is poor. What is the most likely cause?

A.The Route 53 health checks are failing, causing traffic to be routed to a different region.

B.The company has not enabled DNSSEC, causing additional DNS resolution time.

C.The application in the Asian region is overloaded, causing increased response times.

D.The Route 53 latency routing policy is not using anycast, causing suboptimal routing.

AnswerC

Latency routing only optimizes network path; application slowdown still causes high latency.

Why this answer

Route 53 latency-based routing measures the network latency between the user and the AWS region where the resources are hosted, not the application response time. If the application in the Asian region is overloaded, it will respond slowly, causing high latency for users even though traffic is correctly routed to the nearest region. Option A is incorrect because health checks would cause failover to another region, which would not explain high latency when traffic still goes to Asia.

Option B is incorrect because DNSSEC adds minimal overhead and does not significantly impact latency. Option D is incorrect because anycast is used by Route 53 for DNS query resolution, not for the routing policy itself; the latency policy already directs users to the region with the lowest network latency.

Full explanation →

608

MCQmedium

A network engineer is troubleshooting connectivity between a VPC (10.0.0.0/16) and a peered VPC (10.1.0.0/16). The route table shown is associated with subnet-aaa. An EC2 instance in subnet-aaa cannot reach an instance in the peered VPC. What is the issue?

A.The route to the peered VPC's CIDR is missing

B.The route table does not have a route to an Internet Gateway

C.The route table is not associated with the correct subnet

D.The VPC peering connection is not in the 'active' state

AnswerD

If the peering connection is pending or rejected, traffic will not flow even though the route exists.

Why this answer

A VPC peering connection must be in the 'active' state for traffic to flow between the VPCs. If the peering connection is in any other state (e.g., 'pending-acceptance', 'expired', 'failed', or 'deleted'), the route to the peered VPC's CIDR will be considered a black hole, and the EC2 instance in subnet-aaa will be unable to reach the instance in the peered VPC. The route table shown includes a route for 10.1.0.0/16 pointing to the peering connection, but the connection's state must be verified as 'active' for the route to be effective.

Exam trap

AWS often tests the misconception that simply adding a route to the peered VPC's CIDR in the route table is sufficient for connectivity, but the trap here is that the VPC peering connection must be in the 'active' state; otherwise, the route is a black hole and traffic will not flow.

How to eliminate wrong answers

Option A is wrong because the route table shown includes a route for 10.1.0.0/16 with the peering connection as the target, so the route to the peered VPC's CIDR is present, not missing. Option B is wrong because an Internet Gateway route is irrelevant for VPC peering traffic; the EC2 instance is trying to reach a private IP in the peered VPC, not the internet, and the route table does not need an IGW route for this communication. Option C is wrong because the question states the route table is associated with subnet-aaa, and the EC2 instance is in subnet-aaa, so the association is correct; the issue lies elsewhere.

Full explanation →

609

MCQhard

A company is deploying a global application with users in North America and Europe. They have set up an Application Load Balancer (ALB) in us-east-1 and another in eu-west-1. They want to route users to the nearest ALB using AWS Global Accelerator. What is the correct configuration to achieve this?

A.Use Amazon CloudFront with origins pointing to each ALB

B.Place each ALB behind a Network Load Balancer and use Global Accelerator

C.Create a Global Accelerator accelerator with endpoint groups in each region, each pointing to the respective ALB

D.Create a Route 53 latency record set with aliases to each ALB

AnswerC

Correct; Global Accelerator uses Anycast to route to the nearest healthy ALB.

Why this answer

AWS Global Accelerator uses Anycast IPs to direct traffic to the nearest healthy endpoint group. By creating an accelerator with endpoint groups in us-east-1 and eu-west-1, each pointing to its respective ALB, Global Accelerator automatically routes users to the closest region based on latency and network conditions. This provides both performance optimization and high availability without additional intermediate load balancers.

Exam trap

The trap here is that candidates often confuse Global Accelerator with CloudFront or Route 53 latency routing, not realizing that Global Accelerator provides static IP addresses and sub-second failover by using Anycast at the network layer, whereas CloudFront is a CDN and Route 53 is DNS-based with inherent caching delays.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront is a content delivery network (CDN) optimized for caching static and dynamic content at edge locations, not for routing TCP/UDP traffic to the nearest ALB; it would add unnecessary latency and complexity for non-HTTP traffic or real-time applications. Option B is wrong because placing each ALB behind a Network Load Balancer (NLB) is unnecessary and adds an extra hop; Global Accelerator can directly use ALBs as endpoints in endpoint groups without requiring an NLB intermediary. Option D is wrong because Route 53 latency record sets rely on DNS-based routing, which introduces caching and TTL delays, cannot provide fast failover or static IP addresses, and does not offer the same performance optimization as Global Accelerator's Anycast network.

Full explanation →

610

Multi-Selecthard

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The company wants to centralize internet egress for all VPCs through a single VPC that has a NAT Gateway and an internet gateway. Which TWO configurations are required to achieve this?

Select 2 answers

A.In the egress VPC, add a route for 0.0.0.0/0 to the Transit Gateway.

B.Create a VPN connection between each VPC and the Transit Gateway.

C.In the egress VPC, add a route for 0.0.0.0/0 to the internet gateway in the route table of the subnet containing the NAT Gateway.

D.In each non-egress VPC, add a route for 0.0.0.0/0 to the Transit Gateway.

E.In each non-egress VPC, delete the local route.

AnswersC, D

This allows the NAT Gateway to reach the internet via the internet gateway.

Why this answer

The egress VPC must route traffic from the NAT Gateway to the internet gateway for internet-bound traffic. The NAT Gateway resides in a public subnet with a route table that directs 0.0.0.0/0 to the internet gateway, enabling outbound connectivity. This allows the NAT Gateway to translate private IPs from other VPCs and forward traffic to the internet.

Exam trap

The trap here is that candidates often think the egress VPC needs a route to the Transit Gateway for 0.0.0.0/0, but this would create a loop; instead, the egress VPC must route directly to the internet gateway, while non-egress VPCs point to the Transit Gateway.

Full explanation →

611

Multi-Selectmedium

A company is designing a VPC with multiple subnets for a three-tier application. They need to ensure that the database tier (private subnet) can be accessed only by the application tier (private subnet) and that no other resources in the VPC can access the database. Which TWO security mechanisms should be used together to achieve this? (Choose TWO.)

Select 2 answers

A.Route tables

B.VPC Flow Logs

C.Security groups

D.Network ACLs

E.IAM policies attached to the database instances

AnswersC, D

Correct; security groups act as virtual firewalls at the instance level.

Why this answer

Options C (Security groups) and D (Network ACLs) are correct. Security groups act as stateful firewalls at the instance level, allowing traffic from the application tier to the database instances. Network ACLs provide stateless filtering at the subnet level, restricting inbound traffic to the database subnet exclusively from the application subnet.

Together, they enforce the required access control. Option A is incorrect because route tables control network routing, not traffic filtering. Option B (VPC Flow Logs) is for monitoring network traffic, not access control.

Option E (IAM policies) manage permissions for AWS API calls, not network traffic.

Full explanation →

612

Multi-Selecteasy

Which TWO of the following are best practices for securing a VPC?

Select 2 answers

A.Enable VPC Flow Logs on all subnets to block malicious traffic.

B.Use multiple Availability Zones for redundancy.

C.Place database instances in public subnets for easier management.

D.Restrict inbound SSH access to specific IP ranges.

E.Use the default VPC security group for all instances.

AnswersB, D

Improves availability and fault tolerance.

Why this answer

(Use multiple Availability Zones) is correct because it provides redundancy and improves availability, which is a key security best practice by ensuring fault tolerance. Option D (Restrict inbound SSH access to specific IP ranges) is correct as it minimizes the attack surface by limiting administrative access to authorized IPs only. Option A is wrong: VPC Flow Logs capture IP traffic information but do not block traffic; they are used for monitoring and analysis, not as a security control.

Option C is wrong: placing databases in public subnets exposes them to the internet, increasing risk; they should be in private subnets with controlled access. Option E is wrong: the default VPC security group allows all inbound traffic, which is overly permissive; custom security groups should be used to implement least privilege.

Full explanation →

613

MCQeasy

A network engineer is designing a VPC with public and private subnets. The private subnets must have outbound internet access but not be directly reachable from the internet. Which AWS service should be used?

A.NAT Gateway

B.Elastic IP Address (EIP)

C.Internet Gateway (IGW)

D.Virtual Private Gateway (VGW)

AnswerA

NAT Gateway provides outbound internet without inbound.

Why this answer

A NAT Gateway is the correct choice because it enables instances in private subnets to initiate outbound internet traffic (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT Gateway's Elastic IP address, providing one-way internet access without direct reachability.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with an Internet Gateway, mistakenly thinking an IGW can provide outbound-only access, when in fact an IGW allows bidirectional traffic and would expose private subnets to the internet.

How to eliminate wrong answers

Option B (Elastic IP Address) is wrong because an EIP is a static public IPv4 address that, when attached to an instance, makes that instance directly reachable from the internet, which violates the requirement that private subnets not be directly reachable. Option C (Internet Gateway) is wrong because an IGW allows bidirectional communication between a VPC and the internet; attaching an IGW to a private subnet would make instances in that subnet directly reachable from the internet, defeating the purpose of a private subnet. Option D (Virtual Private Gateway) is wrong because a VGW is used to establish VPN or Direct Connect connections to on-premises networks, not to provide outbound internet access from a VPC.

Full explanation →

614

MCQhard

A company is running a two-tier application with a web tier and a database tier. The web tier must be accessible from the internet, but the database tier should only be accessible from the web tier. Which architecture should they use?

A.Web tier in public subnet, database tier in private subnet with a security group allowing only web tier.

B.Both tiers in public subnets with security groups restricting database access.

C.Both tiers in private subnets with a NAT Gateway for internet access.

D.Web tier in private subnet, database tier in public subnet with a security group.

AnswerA

This architecture provides internet access to the web tier and isolates the database.

Why this answer

The correct architecture places the web tier in a public subnet with an internet gateway for inbound traffic, and the database tier in a private subnet with a security group that only allows inbound traffic from the web tier's security group. This ensures the database is not directly reachable from the internet, adhering to the principle of least privilege and defense in depth. The security group acts as a stateful virtual firewall, allowing you to reference the web tier's security group as the source, which automatically adapts to any changes in the web tier's IP addresses.

Exam trap

The ANS-C01 exam often tests the misconception that security groups alone can secure a database in a public subnet, but the trap here is that a public subnet inherently provides a route to the internet via an internet gateway, making the database reachable from the internet even with restrictive security groups.

How to eliminate wrong answers

Option B is wrong because placing both tiers in public subnets exposes the database tier to the internet, even with security group restrictions; a misconfiguration or a zero-day vulnerability could still allow direct internet access to the database. Option C is wrong because placing both tiers in private subnets would require a NAT Gateway for the web tier to receive internet traffic, but a NAT Gateway only supports outbound-initiated traffic, not inbound connections from the internet, making the web tier inaccessible. Option D is wrong because placing the web tier in a private subnet and the database tier in a public subnet reverses the security model, exposing the database directly to the internet while the web tier cannot be reached from the internet without additional components like a load balancer or VPN.

Full explanation →

615

Multi-Selecthard

A company has a VPC with a public subnet and a private subnet. The private subnet hosts Amazon RDS instances. The security team wants to ensure that the RDS instances are not accessible from the internet. Which TWO actions should be taken?

Select 2 answers

A.Disable the 'Publicly accessible' option for the RDS instances.

B.Create a network ACL that denies all inbound traffic from 0.0.0.0/0.

C.Remove the route to an internet gateway from the private subnet's route table.

D.Ensure that the RDS instances are launched in a private subnet without a public IP address.

E.Configure the security group for the RDS instances to deny all inbound traffic.

AnswersC, D

Without a route to an internet gateway, traffic cannot reach the internet.

Why this answer

Options C and D are the correct actions. Removing the route to an internet gateway from the private subnet's route table ensures that the subnet cannot send traffic to or receive traffic from the internet. Launching RDS instances in a private subnet without a public IP address ensures they do not have direct internet connectivity.

Option A is not effective because disabling 'Publicly accessible' only prevents RDS from being assigned a public IP address, but if the instance is in a public subnet with a public route, it could still be accessible. Option B is incorrect because a network ACL that denies all inbound traffic from 0.0.0.0/0 would block all inbound traffic, including necessary traffic from within the VPC, and is not a recommended approach. Option E is wrong because configuring a security group to deny all inbound traffic would block all inbound connections, which would prevent legitimate access to RDS from authorized resources.

Full explanation →

616

MCQeasy

A security engineer is designing a VPC with public and private subnets. The company requires that all outbound traffic from private subnets to the internet must go through a single IP address for logging and compliance. Which service should be used?

A.Transit Gateway

B.Internet Gateway

C.NAT Gateway

D.VPC Endpoint

AnswerC

A NAT Gateway provides outbound-only internet access with a single IP.

Why this answer

NAT Gateway. A NAT Gateway provides outbound internet access from private subnets, and it uses a single Elastic IP address, meeting the requirement for a single IP for logging and compliance. Option A is wrong because a Transit Gateway is used for connecting multiple VPCs and on-premises networks, not for outbound internet from private subnets.

Option B is wrong because an Internet Gateway allows inbound and outbound traffic from public subnets, not private subnets. Option D is wrong because a VPC Endpoint is for accessing AWS services privately without traversing the internet.

Full explanation →

617

MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates. The instance is associated with an Elastic IP address. The route table for the private subnet has a default route (0.0.0.0/0) pointing to a NAT gateway. The NAT gateway is in the public subnet and has an Elastic IP. Despite this, the instance cannot reach the internet. The security groups and NACLs are properly configured. What is the likely cause?

A.The NAT gateway's Elastic IP is not associated with the NAT gateway

B.The NAT gateway is not in a public subnet

C.The private subnet's network ACL is blocking outbound traffic

D.The EC2 instance does not have a route to the internet

AnswerB

This is correct. For a NAT gateway to provide internet access, it must be in a public subnet with a route to an internet gateway. If the subnet's route table does not have a 0.0.0.0/0 route pointing to an internet gateway, the NAT gateway cannot reach the internet.

Why this answer

The instance cannot reach the internet because the NAT gateway, although placed in a subnet labeled as public, is not in a functional public subnet—the subnet's route table must include a default route (0.0.0.0/0) pointing to an internet gateway. The problem statement indicates the NAT gateway has an Elastic IP, so association is not the issue. Instead, the likely cause is that the public subnet's route table lacks this route, meaning the NAT gateway cannot communicate with the internet gateway.

Option A is incorrect because the NAT gateway's Elastic IP is properly associated. Option C is incorrect because NACLs are properly configured. Option D is incorrect because the private subnet route table correctly points to the NAT gateway for 0.0.0.0/0.

Exam trap

Many candidates assume that placing a NAT gateway in a subnet labeled 'public' is sufficient, but the subnet must also have a route to an internet gateway to be truly public.

Full explanation →

618

MCQeasy

An IAM policy is attached to a user. What is the effect when the user attempts to launch an EC2 instance of type m5.large?

A.The action is allowed because the policy allows t2.micro instances.

B.The action is allowed because there is no explicit allow for RunInstances.

C.The action is denied because the condition is not met.

D.The action is denied because the instance type does not equal t2.micro.

AnswerD

The Deny statement with the condition StringNotEquals blocks all instance types except t2.micro.

Why this answer

The IAM policy attached to the user includes an Allow statement for ec2:RunInstances only when the condition ec2:InstanceType equals t2.micro. Since the user is attempting to launch an m5.large instance, the condition is not satisfied, and the Allow statement does not apply. Consequently, the default implicit deny takes effect, and the action is denied.

It is not an explicit denial but rather the absence of an applicable Allow.

Exam trap

Candidates often confuse implicit deny with an explicit Deny statement. In this question, the policy does not contain an explicit Deny; instead, the Allow statement has a condition that is not met, resulting in the default implicit deny. A common error is to think that because there is no explicit Deny, the action would be allowed, but that is incorrect; the Action is denied because no applicable Allow exists.

How to eliminate wrong answers

Option A is wrong because the policy does not allow all instance types; it only allows `t2.micro`, so launching `m5.large` is not permitted. Option B is wrong because there is an explicit allow for `RunInstances` in the policy, but it is conditional; the absence of an explicit allow for the specific instance type means the default deny applies. Option C is wrong because the condition is not met (the instance type is not `t2.micro`), which causes the allow to not apply, but the denial is due to the implicit deny, not because the condition itself is evaluated as a denial.

Full explanation →

619

MCQhard

A company is deploying a multi-region application and needs to route users to the nearest healthy endpoint. They are using Amazon Route 53 with latency-based routing and health checks. Users in Asia are sometimes routed to the US region even when the Asia endpoint is healthy. What is the most likely cause?

A.The Asia region endpoint's Route 53 geolocation routing policy is misconfigured

B.The health check for the Asia region endpoint is failing or misconfigured

C.The TTL value for the DNS records is set too high

D.The DNS resolver used by users in Asia does not support latency-based routing

AnswerB

If the health check fails, Route 53 excludes the unhealthy endpoint and routes to the next best latency.

Why this answer

Latency-based routing selects the endpoint with the lowest latency for the user. If users in Asia are routed to the US even when the Asia endpoint is healthy, the most likely cause is that the health check for the Asia endpoint is failing or misconfigured. When a health check fails, Route 53 considers the endpoint unhealthy and excludes it from latency-based routing, causing traffic to be sent to the next-best region (e.g., US).

Exam trap

The trap here is that candidates may assume latency-based routing always routes to the geographically closest region, but it actually routes based on measured network latency, and a failing health check overrides latency calculations by excluding the endpoint entirely.

How to eliminate wrong answers

Option A is wrong because geolocation routing is a separate policy that routes based on user location, not latency; the question explicitly states latency-based routing is used, so a geolocation misconfiguration would not affect latency-based routing behavior. Option C is wrong because a high TTL value would cause DNS caching and delayed propagation of record changes, but it would not cause consistent routing to a different region when the local endpoint is healthy; the issue described is a routing decision, not a caching delay. Option D is wrong because DNS resolvers do not need to 'support' latency-based routing; Route 53 performs the latency evaluation on the server side based on the resolver's IP address, and all standard DNS resolvers work with this mechanism.

Full explanation →

620

Multi-Selectmedium

A company is designing a network for a three-tier web application that must be highly available across multiple Availability Zones. The application uses an Application Load Balancer (ALB) for the web tier, EC2 instances for the application tier, and an Amazon RDS Multi-AZ database for the database tier. Which TWO design choices improve availability and fault tolerance?

Select 2 answers

A.Launch all EC2 instances in a single Availability Zone to reduce network latency.

B.Configure Amazon RDS Multi-AZ with a standby instance in a different Availability Zone.

C.Use a single NAT gateway in one Availability Zone for all outbound traffic.

D.Deploy the ALB across at least two Availability Zones.

E.Use VPC Gateway Endpoints for S3 to avoid NAT gateway costs.

AnswersB, D

Provides automatic failover.

Why this answer

Amazon RDS Multi-AZ automatically provisions and maintains a synchronous standby replica in a different Availability Zone, providing automatic failover in the event of an AZ failure or database instance failure. This ensures the database tier remains available without manual intervention, directly improving fault tolerance for the three-tier application.

Exam trap

AWS often tests the misconception that a single NAT gateway is sufficient for high availability, but the trap here is that a single NAT gateway is a single point of failure unless paired with a second NAT gateway in another AZ and route tables that direct traffic to the healthy gateway.

Full explanation →

621

MCQmedium

A network engineer is designing a hybrid network with AWS Direct Connect and a VPN backup. The company has multiple VPCs connected to an AWS Transit Gateway. The on-premises network advertises the same prefixes over both Direct Connect (via private VIF) and VPN (via BGP). The engineer wants to ensure that traffic from the VPCs to on-premises prefers the Direct Connect path. What should the engineer do?

A.Set a higher local preference on the Transit Gateway for Direct Connect routes

B.Decrease the AS path length on the Direct Connect BGP advertisements

C.Configure AS path prepending on the VPN BGP advertisements from on-premises

D.Set a higher MED on the Direct Connect BGP advertisements

AnswerC

Longer AS path makes the VPN route less preferred.

Why this answer

To prefer the Direct Connect path, the engineer should make the VPN path less preferred in BGP path selection. AS path prepending on the VPN BGP advertisements artificially increases the AS path length, making the VPN route less preferred compared to the Direct Connect route (which has a shorter AS path). Option A is incorrect because local preference is a BGP attribute typically set on the receiving router within an AS, not on the Transit Gateway; the Transit Gateway does not set local preference for routes received from on-premises.

Option B is incorrect because you cannot decrease the AS path length below the actual path; the Direct Connect path already has the minimum path length. Option D is incorrect because setting a higher MED (Multi-Exit Discriminator) on the Direct Connect advertisements would make them less preferred (lower MED is better), which is the opposite of what is desired.

Full explanation →

622

Multi-Selectmedium

Which THREE of the following are valid methods to connect a VPC to an on-premises network?

Select 3 answers

A.AWS Direct Connect

B.VPC Peering

C.Site-to-Site VPN

D.AWS Transit Gateway

E.VPC Endpoint

AnswersA, C, D

Direct Connect provides a dedicated private connection.

Why this answer

AWS Direct Connect is a valid method to connect a VPC to an on-premises network because it provides a dedicated, private, high-bandwidth physical connection from your on-premises data center to AWS, bypassing the public internet. This connection uses industry-standard 802.1Q VLANs to create virtual interfaces (VIFs) that directly access VPCs or AWS services, offering consistent network performance and reduced latency compared to internet-based connections.

Exam trap

The trap here is that candidates often confuse VPC Peering (which only connects VPCs) or VPC Endpoints (which only connect to AWS services) as valid methods for on-premises connectivity, when in fact only Direct Connect, Site-to-Site VPN, and Transit Gateway (which can aggregate VPN and Direct Connect connections) are correct.

Full explanation →

623

MCQmedium

A network engineer is setting up a VPC peering connection between two VPCs (VPC-A and VPC-B) in different AWS accounts. The VPCs are in the same region. After accepting the peering request, instances in VPC-A cannot communicate with instances in VPC-B. What should the engineer check first?

A.The security groups in both VPCs allow traffic from the peer VPC CIDR.

B.The network ACLs in both VPCs allow traffic from the peer VPC CIDR.

C.The route tables in both VPCs have routes to the peer VPC CIDR.

D.The VPC peering connection status is 'active'.

AnswerC

Route tables must be updated with routes to the peer VPC CIDR. Without these routes, traffic is not directed to the peering connection.

Why this answer

For VPC peering to work, each VPC's route table must have a route to the peer VPC's CIDR block pointing to the peering connection. Without these routes, traffic will not be directed across the peering link. Option A is incorrect because security groups are stateful and can allow traffic, but they are not the first check; the routing issue is more fundamental.

Option B is incorrect because network ACLs are stateless and could block traffic, but again, routing is the primary concern. Option D is incorrect because while the VPC peering connection status should be 'active' for traffic to flow, the most common issue after accepting the request is missing route table entries; thus, checking route tables should be the first step.

Full explanation →

624

MCQhard

A company has a hybrid network with an AWS Transit Gateway connecting multiple VPCs and an on-premises data center via AWS Direct Connect. The security team requires that all traffic between VPCs must be inspected by a centralized firewall appliance deployed in a security VPC. They have configured a Transit Gateway with a route table that has blackhole routes for all VPC CIDRs except the security VPC, and the security VPC appliance performs inspection and returns traffic to the Transit Gateway. Recently, they added a new VPC for a critical application. After configuration, some traffic from the new VPC to other VPCs is being dropped. The network engineer verifies that the Transit Gateway route table includes a blackhole route for the new VPC's CIDR and that the security VPC's firewall rules allow the traffic. What is the most likely cause of the dropped traffic?

A.The security VPC's network ACLs are blocking return traffic from the firewall appliance back to the Transit Gateway.

B.The new VPC's route table does not have a default route pointing to the Transit Gateway attachment.

C.The Transit Gateway route table propagates the new VPC's CIDR, overriding the static blackhole route.

D.The Transit Gateway route table does not have a static route pointing to the security VPC attachment for the new VPC's CIDR.

AnswerD

The Transit Gateway route table must have a route for the new VPC's CIDR pointing to the security VPC attachment so that traffic from the new VPC is forwarded to the firewall for inspection. Without this route, traffic is blackholed.

Full explanation →

625

Multi-Selecthard

A company has a VPC with CIDR 10.0.0.0/16. They have two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). An EC2 instance in subnet A needs to communicate with an RDS database in subnet B. Both subnets have network ACLs that allow all inbound and outbound traffic. However, the instance cannot connect to the database. Which TWO configuration changes could solve this issue? (Choose TWO.)

Select 2 answers

A.Attach an Internet Gateway to the VPC.

B.Ensure that the route tables associated with both subnets have a local route for the VPC CIDR.

C.Create a VPC peering connection between the subnets.

D.Modify the security group for the RDS database to allow inbound traffic from the EC2 instance's security group on port 3306.

E.Add a NAT Gateway in a public subnet and route traffic through it.

AnswersB, D

Local route is needed for intra-VPC communication.

Why this answer

The local route for the VPC CIDR (10.0.0.0/16) is automatically added to the main route table, but if custom route tables are associated with subnets A and B, they must explicitly include this local route to enable routing between subnets within the same VPC. Without it, traffic from the EC2 instance in subnet A cannot reach the RDS database in subnet B, even if network ACLs allow all traffic.

Exam trap

AWS often tests the misconception that network ACLs alone control all traffic flow, but candidates forget that security groups must also allow inbound traffic, and that route tables must have a local route for intra-VPC communication.

Full explanation →

626

MCQeasy

A company is deploying a public-facing web application on EC2 instances behind an Application Load Balancer. The ALB is configured to terminate HTTPS using a certificate from AWS Certificate Manager. What additional step is required to ensure the ALB can validate the certificate?

A.Attach the certificate to an Amazon CloudFront distribution.

B.Ensure the certificate is in the same AWS region as the ALB.

C.Create a DNS record to validate domain ownership.

D.Import the certificate into AWS Certificate Manager Private Certificate Authority.

AnswerB

ACM certificates are region-specific.

Why this answer

For an Application Load Balancer to terminate HTTPS using a certificate from AWS Certificate Manager (ACM), the certificate must be in the same AWS region as the ALB. ACM certificates are region-specific resources; the ALB can only reference certificates that are stored in the same region where the ALB is deployed. This is a fundamental constraint of ACM integration with regional services like ALB.

Exam trap

The ANS-C01 exam often tests the misconception that ACM certificates are globally available or can be used across regions, when in fact they are region-specific and must match the ALB's region.

How to eliminate wrong answers

Option A is wrong because attaching the certificate to a CloudFront distribution is an alternative way to serve HTTPS content, but it does not help the ALB validate or use the certificate; CloudFront requires its own certificate (either from ACM in us-east-1 or imported) and is a separate service. Option C is wrong because DNS record validation is a method to prove domain ownership when requesting a certificate from ACM, not a step required after the certificate is issued and being used by the ALB; the certificate validation is already complete before it can be deployed. Option D is wrong because importing the certificate into ACM Private Certificate Authority (PCA) is for creating private certificates for internal use, not for public-facing web applications; the question specifies a public-facing application using a certificate from ACM (public CA), and PCA is irrelevant here.

Full explanation →

627

MCQhard

A network engineer is troubleshooting a VPN connection between an on-premises network (172.16.0.0/16) and an AWS VPC (10.0.0.0/16). The VPN status is 'available' but traffic is not passing. The engineer runs the command shown in the exhibit. What is the most likely cause of the issue?

A.The VPN tunnels are not in 'UP' state.

B.The VPC route table does not have a route for 172.16.0.0/16 pointing to the virtual private gateway.

C.The tunnel inside CIDRs overlap with the VPC CIDR.

D.The BGP session is not established.

AnswerB

Without this route, VPC traffic to on-premises is dropped.

Why this answer

The VPN status is 'available', which indicates that the VPN tunnels are established and the BGP sessions (if configured) are up. However, traffic still fails because the VPC route table lacks a route for the on-premises CIDR (172.16.0.0/16) pointing to the virtual private gateway (VGW). Without this route, the VPC does not know to send traffic destined for the on-premises network through the VPN connection, even though the tunnels themselves are operational.

Exam trap

The trap here is that candidates see 'available' status and assume all components are working, but they overlook the critical requirement of a route in the VPC route table pointing to the virtual private gateway for the on-premises CIDR.

How to eliminate wrong answers

Option A is wrong because the VPN status 'available' means the tunnels are in 'UP' state; if they were not, the status would be 'down' or 'degraded'. Option C is wrong because tunnel inside CIDRs (typically link-local addresses like 169.254.x.x) are used for BGP peering and do not overlap with the VPC CIDR (10.0.0.0/16); overlapping inside CIDRs would cause a different error, such as BGP session failure, not a traffic pass issue with 'available' status. Option D is wrong because the VPN status 'available' indicates that the BGP session is established; if BGP were not established, the status would show 'down' or 'negotiation'.

Full explanation →

628

Multi-Selectmedium

Which TWO of the following are valid methods to secure data at rest in Amazon S3? (Choose two.)

Select 2 answers

A.Use SSE-S3 (Server-Side Encryption with S3 managed keys).

B.Use SSL/TLS to encrypt data during transfer.

C.Use client-side encryption before uploading objects.

D.Use a VPC endpoint to restrict access to the bucket.

E.Configure a network ACL to block unauthorized access.

AnswersA, C

Correct. SSE-S3 is a server-side encryption option that protects data at rest using S3-managed keys.

Why this answer

Options A and C are correct. SSE-S3 (Server-Side Encryption with S3 managed keys) encrypts data at rest on S3. Client-side encryption, where the customer encrypts data before uploading, also protects data at rest.

Option B (SSL/TLS) encrypts data in transit, not at rest. Option D (VPC endpoint) restricts network access but does not encrypt. Option E (network ACL) controls traffic but does not encrypt data.

Full explanation →

629

MCQeasy

A company needs to connect its on-premises data center to a VPC in AWS using a dedicated, private, and high-bandwidth connection. Which AWS service should be used?

A.AWS Client VPN

B.VPC Peering

C.AWS Site-to-Site VPN

D.AWS Direct Connect

AnswerD

Dedicated private connection.

Why this answer

AWS Direct Connect is the correct choice because it provides a dedicated, private, high-bandwidth network connection from an on-premises data center directly to AWS, bypassing the public internet. This meets the requirements for a private, low-latency, and consistent network path, unlike VPN-based solutions that traverse the internet.

Exam trap

The trap here is that candidates often confuse AWS Site-to-Site VPN with a dedicated connection, overlooking that it still relies on the public internet and lacks the private, consistent bandwidth guarantees of Direct Connect.

How to eliminate wrong answers

Option A is wrong because AWS Client VPN is a managed remote access VPN service for individual clients (e.g., laptops) to connect to AWS or on-premises networks, not a dedicated high-bandwidth connection between a data center and a VPC. Option B is wrong because VPC Peering connects two VPCs within AWS, not an on-premises data center to a VPC, and it does not provide a dedicated physical connection. Option C is wrong because AWS Site-to-Site VPN creates an encrypted tunnel over the public internet, which does not offer the dedicated, private, or consistent high-bandwidth characteristics required; it is subject to internet variability and latency.

Full explanation →

630

MCQhard

An IAM policy attached to a user allows creating and deleting VPCs and subnets only in us-east-1. The user attempts to create a VPC in eu-west-1. What will happen?

A.The API call will be denied with an authorization error.

B.The VPC will be created but the user will receive a warning.

C.The user can create the VPC because the condition is not applicable to VPC creation.

D.The VPC will be created successfully because the policy allows ec2:CreateVpc.

AnswerA

The condition fails, so IAM denies the action.

Why this answer

The IAM policy explicitly restricts the ec2:CreateVpc action to us-east-1 using a Condition element with ec2:Region. When the user attempts to create a VPC in eu-west-1, the condition is not satisfied, so the request is denied with an authorization error (HTTP 403). IAM policies are evaluated before any API call is executed, and if the condition fails, the action is blocked regardless of the resource-level permissions.

Exam trap

The trap here is that candidates assume a policy that allows ec2:CreateVpc without a resource restriction will permit VPC creation in any region, but they overlook the Condition element that scopes the permission to a specific region, causing them to pick Option D.

How to eliminate wrong answers

Option B is wrong because AWS IAM does not issue warnings; it either allows or denies the API call based on policy evaluation, and a denied request results in an explicit error. Option C is wrong because the condition is directly applicable to VPC creation—the ec2:Region condition key is evaluated for the ec2:CreateVpc action, and if the region does not match, the policy denies the request. Option D is wrong because the policy does not allow ec2:CreateVpc globally; it only allows the action when the condition (us-east-1) is met, so the request to eu-west-1 is denied.

Full explanation →

631

MCQhard

A network engineer is monitoring a hybrid network with a VPN connection to AWS. The engineer notices periodic packet loss and high latency during peak hours. The VPN tunnel uses static routing. The on-premises bandwidth is 100 Mbps, and the VPN connection is limited to 1.25 Gbps. What is the most likely cause?

A.The VPC route table has a blackhole route for the on-premises CIDR.

B.The on-premises internet connection is saturated.

C.The VPN tunnel is using the incorrect encryption algorithm.

D.The VPN tunnel is exceeding its maximum bandwidth limit.

AnswerB

The 100 Mbps link is likely overwhelmed during peak hours, causing packet loss and high latency.

Why this answer

The VPN connection's bandwidth (1.25 Gbps) is sufficient, but if the on-premises link is only 100 Mbps, any traffic exceeding that will cause congestion and packet loss. The VPN tunnel itself is not the bottleneck.

Full explanation →

632

MCQhard

A company has multiple VPCs connected via AWS Transit Gateway. Each VPC has its own route table in the transit gateway. The company wants to restrict traffic between certain VPCs. For example, VPC A should be able to send traffic to VPC B but not to VPC C. VPC B should be able to send traffic to VPC C. Which configuration should the company use?

A.Use network ACLs on the transit gateway attachments to filter traffic.

B.Use security groups on the VPC attachments to allow or deny traffic.

C.Create separate transit gateway route tables for each VPC and add only the desired routes for other VPCs.

D.Create a single transit gateway route table and associate all VPC attachments with it.

AnswerC

Enables selective communication.

Why this answer

AWS Transit Gateway supports multiple route tables, and by creating a separate route table for each VPC attachment, you can control which VPCs can communicate by selectively adding routes to the desired destination VPC CIDRs. This allows VPC A to have a route only to VPC B, while VPC B's route table includes routes to both VPC A and VPC C, achieving the required traffic isolation without relying on stateful or stateless filtering at the attachment level.

Exam trap

The trap here is that candidates often confuse Transit Gateway route tables with VPC route tables or assume that security groups or network ACLs can be applied to Transit Gateway attachments, when in fact route table isolation is the only native mechanism for controlling inter-VPC traffic at the Transit Gateway level.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless packet filters that operate at the subnet level within a VPC, not on Transit Gateway attachments; Transit Gateway does not support network ACLs on attachments. Option B is wrong because security groups are stateful firewalls that apply to ENIs within a VPC, not to Transit Gateway VPC attachments; they cannot be directly associated with a Transit Gateway attachment to filter inter-VPC traffic. Option D is wrong because a single transit gateway route table shared by all VPCs would allow any VPC to route traffic to any other VPC that has a route in that table, failing to restrict traffic between VPC A and VPC C.

Full explanation →

633

MCQeasy

A network administrator is setting up VPC Flow Logs to monitor traffic to an Amazon RDS instance. The logs are sent to Amazon S3. After enabling Flow Logs, the administrator notices that no logs are being delivered. What is the most likely cause?

A.The VPC Flow Logs are not enabled for the correct VPC

B.The IAM role for Flow Logs does not have permissions to write to S3

C.The RDS instance is in a private subnet

D.The S3 bucket is in a different region

AnswerB

Flow Logs need an IAM role with s3:PutObject permission on the bucket.

Why this answer

Flow Logs require a service-linked role or an IAM role with permissions to publish to S3. If the role is missing or incorrect, logs will not be delivered.

Full explanation →

634

MCQmedium

A company is designing a network for a multi-tier application. The web tier must be accessible from the internet, the application tier must be accessible only from the web tier, and the database tier must be accessible only from the application tier. Which architecture meets these requirements?

A.Place each tier in a separate subnet and use network ACLs to allow traffic between tiers

B.Place each tier in a separate subnet and use security groups to allow traffic between tiers

C.Place all tiers in the same subnet and use security groups to control traffic

D.Place all tiers in a public subnet and use a NAT gateway for the application and database tiers

AnswerB

This provides isolation and granular control using security groups.

Why this answer

Security groups act as a stateful virtual firewall at the instance level, allowing you to specify inbound and outbound rules based on source/destination security group IDs. By placing each tier in a separate subnet and referencing the web tier's security group as the source for the application tier's inbound rule, and the application tier's security group as the source for the database tier's inbound rule, you achieve the required least-privilege access without exposing the application or database tiers to the internet.

Exam trap

The ANS-C01 exam often tests the distinction between stateful security groups and stateless network ACLs, and the trap here is that candidates assume network ACLs are the correct choice for subnet-level isolation, overlooking that security groups provide more granular, stateful control between tiers.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and require separate inbound and outbound rules for return traffic, making them more complex to manage and less precise for instance-level control compared to security groups. Option C is wrong because placing all tiers in the same subnet would allow lateral traffic between instances unless explicitly blocked, and security groups alone cannot prevent all inter-tier traffic if they are not correctly referenced; more importantly, the web tier would be in the same subnet as the database, violating the isolation requirement. Option D is wrong because placing all tiers in a public subnet exposes the application and database tiers to the internet directly, and a NAT gateway is used for outbound internet access from private subnets, not for controlling inbound access between tiers.

Full explanation →

635

MCQhard

A security engineer is troubleshooting connectivity issues. An EC2 instance cannot access the internet. The instance is in a private subnet with a route table that has a default route (0.0.0.0/0) pointing to a NAT gateway. The NAT gateway is in a public subnet with an Elastic IP. The security group allows all outbound traffic. What is the most likely cause?

A.The network ACL in the public subnet is blocking inbound traffic to the NAT gateway

B.The NAT gateway does not have a security group allowing outbound traffic

C.The internet gateway is not attached to the VPC

D.The route table in the private subnet has no route to the NAT gateway

AnswerA

NAT gateway needs inbound allowance for return traffic.

Why this answer

The network ACL in the public subnet must allow inbound traffic from the internet to the NAT gateway's Elastic IP. Option B is wrong because the route table in the private subnet is correct. Option C is wrong because the NAT gateway's security group is not a thing; it uses security groups for instances.

Option D is wrong because the internet gateway is required and assumed attached.

Full explanation →

636

MCQmedium

A company has a VPC with public and private subnets. They have a web application running on EC2 instances in an Auto Scaling group in the public subnets. The application needs to read and write data to an S3 bucket. They want to ensure that traffic to S3 does not traverse the internet. The security team also requires that all traffic to S3 be logged. The current setup uses a NAT Gateway for outbound internet access. However, the NAT Gateway is a single point of failure and costs are high. They want to replace it with a more cost-effective and highly available solution that meets the logging requirement. What should they do?

A.Set up a VPN connection to an on-premises data center and route S3 traffic through the VPN, enabling VPC Flow Logs.

B.Create a Gateway VPC Endpoint for S3, enable VPC Flow Logs, and remove the NAT Gateway after verifying no other outbound internet traffic is needed.

C.Create an Interface VPC Endpoint for S3 in each Availability Zone, enable VPC Flow Logs, and remove the NAT Gateway.

D.Create a Gateway VPC Endpoint for S3, enable VPC Flow Logs, and keep the NAT Gateway for other outbound traffic.

AnswerB

Gateway Endpoint is free and highly available; VPC Flow Logs provide logging; removing the NAT Gateway reduces cost and SPOF.

Why this answer

A Gateway VPC Endpoint for S3 is free of charge, highly available by design (within a Region), and does not require a NAT Gateway for S3 access. Traffic to S3 remains within the AWS network. VPC Flow Logs can be enabled to capture traffic to the endpoint for logging purposes. After verifying that no other outbound internet traffic is required, the NAT Gateway can be removed to reduce costs and eliminate the single point of failure.

Option A is incorrect because setting up a VPN connection to on-premises does not provide a direct path to S3; traffic would still need to traverse the internet or a partner network, and it adds unnecessary complexity and cost. Option C is incorrect because an Interface VPC Endpoint for S3 incurs hourly charges and data processing fees, making it less cost-effective than a Gateway Endpoint. Option D is incorrect because it keeps the NAT Gateway, which the company wants to replace due to cost and single point of failure concerns; the goal is to remove the NAT Gateway if no other outbound traffic is needed.

Full explanation →

637

MCQhard

A company is deploying a VPC with a public and private subnet in each of three Availability Zones. They need to provide internet access to instances in the private subnets while ensuring that all outbound traffic is logged and that traffic to a particular on-premises CIDR (10.0.0.0/8) is routed via an AWS Direct Connect Virtual Private Gateway. The company has a VPN connection as a backup. Which design should they use?

A.Create a centralized egress VPC with NAT Gateways in each AZ. Peer the application VPCs to the egress VPC. Configure route tables in the application VPCs to send 0.0.0.0/0 to the egress VPC and 10.0.0.0/8 to the Direct Connect Virtual Private Gateway.

B.Place a NAT Gateway in each AZ in the application VPC. Configure route tables to send 0.0.0.0/0 to the NAT Gateway. Use a VPN connection for on-premises traffic.

C.Use a Transit Gateway to connect all VPCs and on-premises. Attach a NAT Gateway in one AZ to the Transit Gateway. Configure route tables to send 0.0.0.0/0 to the NAT Gateway and 10.0.0.0/8 to the Direct Connect Virtual Private Gateway.

D.Create a NAT instance in each private subnet and configure each instance's route table to send 0.0.0.0/0 to the NAT instance. For on-premises traffic, use a VPC peering connection to an on-premises network.

AnswerA

This design centralizes egress traffic, uses managed NAT Gateways, and allows logging. Route tables direct on-premises traffic through DX.

Why this answer

It uses a centralized egress VPC with NAT Gateways in each AZ to provide internet access to private subnets while logging all outbound traffic. By peering the application VPCs to the egress VPC, the route tables can direct 0.0.0.0/0 traffic to the egress VPC for NAT, and 10.0.0.0/8 traffic to the Direct Connect Virtual Private Gateway, ensuring on-premises traffic uses the dedicated connection with VPN backup. This design meets all requirements: internet access, logging, and specific routing for on-premises CIDR.

Exam trap

The trap here is that candidates often assume NAT Gateways must be placed in the same VPC as the private subnets, overlooking the centralized egress VPC pattern that enables logging and centralized control, and they may incorrectly think a Transit Gateway can directly attach a NAT Gateway.

How to eliminate wrong answers

Option B is wrong because it places NAT Gateways in the application VPC, which does not provide centralized logging of all outbound traffic, and it uses a VPN connection for on-premises traffic instead of routing 10.0.0.0/8 via Direct Connect as required. Option C is wrong because attaching a NAT Gateway to a Transit Gateway is not a supported configuration; NAT Gateways cannot be attached to Transit Gateways, and this design would not log all outbound traffic. Option D is wrong because it uses NAT instances instead of NAT Gateways, which are less reliable and do not provide the same level of logging, and it uses VPC peering for on-premises traffic, which is not a valid connection method for on-premises networks (Direct Connect or VPN are required).

Full explanation →

638

MCQeasy

A company has a VPC with a public subnet and a private subnet. The public subnet contains a web server (EC2 instance) that must be accessible from the internet. The private subnet contains a database server (EC2 instance) that should only be accessible from the web server. The web server's security group allows HTTP (80) and HTTPS (443) from 0.0.0.0/0. The database server's security group allows MySQL (3306) from the web server's security group. However, the web server cannot connect to the database server. The network engineer has verified that the web server can reach the internet and that the database server's security group is correctly configured. What is the most likely cause of the connectivity problem?

A.The route table for the private subnet does not have a route to the public subnet.

B.The web server's security group does not allow outbound traffic to the database server.

C.The network ACL associated with the private subnet is blocking inbound MySQL traffic from the web server.

D.The database server does not have a route to the internet gateway.

AnswerC

Correct: A custom NACL can block traffic even if security groups allow it.

Why this answer

Security groups are stateful, meaning that if the web server initiates traffic to the database, the return traffic is automatically allowed regardless of outbound rules in the security group. However, network ACLs (NACLs) are stateless and require explicit inbound and outbound rules. In this scenario, the database server's security group is correctly configured to allow MySQL traffic from the web server's security group, indicating that the security group is not the issue.

The most likely cause is that the network ACL associated with the private subnet is blocking inbound MySQL traffic (port 3306) from the web server. Option A is incorrect because the route table for the private subnet does not need a route to the public subnet for traffic within the same VPC; local routes handle that. Option B is incorrect because security groups are stateful, so outbound traffic from the web server to the database is allowed by default.

Option D is incorrect because the database server does not need a route to the internet gateway for internal VPC communication.

Full explanation →

639

MCQmedium

A security engineer is troubleshooting connectivity between an EC2 instance in a private subnet and an S3 bucket. The instance has a VPC gateway endpoint for S3, and the route table has a route to the endpoint. The security group for the instance allows all outbound traffic. However, the instance cannot access the S3 bucket. What is the most likely cause?

A.The security group outbound rule does not allow traffic to the S3 prefix list.

B.The VPC endpoint is not associated with the route table.

C.The route table does not have a route to a NAT gateway.

D.The S3 bucket policy does not allow access from the VPC endpoint.

AnswerA

Correct: The security group must have an outbound rule allowing HTTPS traffic to the S3 prefix list ID. The default 'all traffic' rule does not suffice.

Why this answer

Although the security group allows all outbound traffic to 0.0.0.0/0, this rule does not apply to traffic destined for the S3 prefix list when using a VPC gateway endpoint. Gateway endpoints require a security group rule that explicitly allows HTTPS traffic to the S3 prefix list ID. Without this rule, traffic is blocked.

Option A is correct. Option B is incorrect because the VPC endpoint is indeed associated with the route table. Option C is incorrect because a NAT gateway is not needed for S3 access via the endpoint.

Option D is incorrect because the bucket policy is not the issue; the security group rule is missing.

Exam trap

Many assume that an 'allow all' outbound security group rule is sufficient for accessing S3 via a gateway endpoint, but the destination must be the prefix list ID.

Full explanation →

640

Multi-Selectmedium

Which TWO of the following are benefits of using an AWS Transit Gateway over VPC peering for connecting multiple VPCs? (Select TWO.)

Select 2 answers

A.Lower data transfer costs between VPCs.

B.Built-in internet gateway for all attached VPCs.

C.Automatic encryption of traffic between VPCs.

D.Transitive routing between all attached VPCs.

E.Centralised management of network policies and routing.

AnswersD, E

Hub-and-spoke model allows any-to-any connectivity.

Why this answer

AWS Transit Gateway supports transitive routing, meaning that any VPC attached to the transit gateway can communicate with any other attached VPC through a single central hub. This eliminates the need to establish a full mesh of VPC peering connections, which would require n*(n-1)/2 individual peering links and manual route table entries for each pair. In contrast, VPC peering does not support transitive routing—if VPC A is peered with VPC B and VPC B is peered with VPC C, VPC A cannot route to VPC C through VPC B.

Exam trap

The ANS-C01 exam often tests the misconception that Transit Gateway provides lower costs or built-in encryption, when in fact the primary benefits are transitive routing and centralized management, not cost savings or automatic security features.

Full explanation →

641

MCQhard

A company has created a VPC Interface Endpoint for Amazon ECR (Docker registry API) as shown in the exhibit. However, an EC2 instance in the same VPC is unable to authenticate with the ECR registry using the private DNS name. What is the most likely cause?

A.Private DNS is not enabled for the endpoint

B.The endpoint service name is incorrect; it should be com.amazonaws.us-east-1.ecr.api

C.The endpoint is not in the 'available' state

D.The endpoint type should be Gateway, not Interface

AnswerA

When PrivateDnsEnabled is false, the private DNS name for the service is not automatically resolved to the endpoint's IPs, causing authentication failures.

Why this answer

The most likely cause is that Private DNS is not enabled for the VPC Interface Endpoint. When Private DNS is enabled, the endpoint automatically associates a Route 53 private hosted zone with the VPC, allowing the default private DNS name (e.g., *.dkr.ecr.us-east-1.amazonaws.com) to resolve to the endpoint's elastic network interface IP addresses. Without this, the EC2 instance will resolve the private DNS name to the public IP of the ECR service, bypassing the endpoint and failing authentication due to network path issues.

Exam trap

The trap here is that candidates often confuse the endpoint service name for ECR (dkr vs. api) or assume a Gateway endpoint can be used for ECR, but the core issue is the Private DNS toggle, which is a subtle but critical setting for Interface endpoints.

How to eliminate wrong answers

Option B is wrong because the endpoint service name for ECR Docker registry API is com.amazonaws.us-east-1.ecr.dkr, not com.amazonaws.us-east-1.ecr.api (the latter is for the ECR API, not the registry). Option C is wrong because if the endpoint were not in the 'available' state, it would not be functional at all, but the question states the endpoint is created as shown, implying it is available; the issue is DNS resolution, not endpoint state. Option D is wrong because ECR requires an Interface endpoint (powered by AWS PrivateLink) for private connectivity to the Docker registry API; a Gateway endpoint is only used for services like S3 and DynamoDB, not for ECR.

Full explanation →

642

MCQeasy

A company uses AWS Site-to-Site VPN to connect its on-premises network to AWS. The VPN connection is established, but traffic from on-premises to AWS is not working. The on-premises network team confirms that the on-premises firewall is allowing traffic to the VPC CIDR. What should the network engineer check in AWS to resolve the issue?

A.Verify that the VPN tunnel status is UP.

B.Review the customer gateway configuration for incorrect BGP settings.

C.Ensure the virtual private gateway is attached to the correct VPC.

D.Check the VPC route tables to ensure routes to the on-premises network point to the virtual private gateway.

AnswerD

Missing routes in the VPC route table would prevent inbound traffic from reaching instances.

Why this answer

Even if the VPN tunnel is up and BGP is peering, traffic will not flow unless the VPC route tables have a route pointing to the virtual private gateway (VGW) for the on-premises CIDR. Without this route, the VPC has no path to forward return traffic back to the on-premises network, causing asymmetric routing or blackholing.

Exam trap

The trap here is that candidates assume a tunnel status of UP (Option A) guarantees traffic flow, but AWS explicitly separates tunnel health from routing configuration, and the exam tests this distinction by requiring you to check the VPC route tables for the correct target.

How to eliminate wrong answers

Option A is wrong because a tunnel status of UP only indicates the IPsec tunnel is established; it does not guarantee that routing or traffic forwarding is configured correctly. Option B is wrong because BGP settings on the customer gateway affect dynamic route exchange, but the question states the VPN connection is established, and BGP misconfiguration would typically prevent route propagation, not cause traffic failure if static routes are used. Option C is wrong because if the VGW were attached to the wrong VPC, the VPN connection would not be established at all, as the VGW is a required endpoint for the VPN; the question confirms the VPN is established, so the VGW is correctly attached.

Full explanation →

643

MCQmedium

A company uses AWS Organizations with SCPs to restrict access. The security team notices that users in the 'Developers' account can launch EC2 instances with public IP addresses, even though the SCP denies ec2:AssociateAddress. What is the most likely reason?

A.The SCP was applied to the wrong organizational unit.

B.The users logged in as the root user of the account.

C.The SCP only applies to the root user, not IAM users.

D.The users assumed an IAM role that bypasses the SCP.

AnswerB

Root user actions are not restricted by SCPs.

Why this answer

SCPs do not apply to the root user of a member account. The root user can perform any action, including launching EC2 instances with public IP addresses, regardless of SCP restrictions. Option A is incorrect because SCPs apply to all IAM users and roles in the target OU, not just specific OUs; the issue here is the use of root user.

Option C is incorrect because SCPs apply to IAM users and roles, not just the root user; the root user is explicitly exempt. Option D is incorrect because IAM roles are subject to SCPs; they cannot bypass SCPs. The correct reason is that the users logged in as the root user, which is not bound by SCPs.

Full explanation →

644

MCQeasy

A network engineer is setting up a site-to-site VPN connection between an on-premises network and an AWS VPC. The engineer configures the customer gateway device with the correct parameters. However, the VPN tunnel status remains 'DOWN'. What is the most likely cause?

A.The virtual private gateway is not attached to the customer gateway.

B.The VPN connection is not associated with a subnet.

C.The pre-shared key on the customer gateway device does not match the pre-shared key configured in the VPN connection.

D.The security group associated with the VPN endpoint is blocking the traffic.

AnswerC

Mismatched PSK prevents IKE negotiation.

Why this answer

The most likely cause is a mismatch in the pre-shared key (PSK) between the customer gateway device and the VPN connection configuration in AWS. IPsec tunnel establishment requires both ends to authenticate using identical PSK values; if they differ, the Internet Key Exchange (IKE) phase 1 negotiation fails, leaving the tunnel status 'DOWN'. This is a common configuration error that directly prevents the VPN from coming up.

Exam trap

The trap here is that candidates confuse security groups (which apply to VPC resources) with VPN tunnel authentication, leading them to incorrectly select Option D, when in fact security groups have no bearing on IPsec tunnel state.

How to eliminate wrong answers

Option A is wrong because the virtual private gateway (VGW) is attached to the VPC, not to the customer gateway (CGW); the CGW is a separate resource that represents the on-premises router, and the VPN connection links the VGW and CGW. Option B is wrong because a VPN connection is not associated with a subnet; it is a logical connection between the VGW and CGW, and traffic is routed via the route table, not by subnet association. Option D is wrong because security groups apply to ENIs within a VPC, not to VPN endpoints; the VPN tunnel operates at Layer 3 (IPsec) and is not subject to security group rules—network ACLs or firewall rules on the CGW could block traffic, but security groups are irrelevant here.

Full explanation →

645

MCQhard

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. They want to ensure that only traffic from specific on-premises IP ranges is allowed into the production VPC. Which approach should they use?

A.Configure the Direct Connect gateway to only advertise specific prefixes to the Transit Gateway.

B.Deploy AWS Network Firewall in the production VPC and configure stateful rule groups to allow only the on-premises IP ranges.

C.Use Transit Gateway route tables to blackhole traffic from other IP ranges.

D.Create a VPC peering connection between the on-premises network and the production VPC.

AnswerB

AWS Network Firewall can inspect and filter traffic between the Transit Gateway attachment and the production VPC.

Why this answer

The company wants to allow only specific on-premises IP ranges into the production VPC. Transit Gateway handles routing between attachments, but it does not filter traffic based on IP addresses. AWS Network Firewall is a managed firewall service that can be deployed in a VPC to inspect and filter traffic.

By deploying Network Firewall in the production VPC and configuring stateful rule groups, the company can allow only traffic from the specified on-premises IP ranges and deny all other traffic. This approach provides granular control and is a recommended practice. Option A is incorrect because a Direct Connect gateway only advertises routes; it does not filter traffic.

Option C is incorrect because Transit Gateway route tables control routing, not filtering; they cannot blackhole traffic based on source IP. Option D is incorrect because VPC peering is used for connecting VPCs, not for connecting on-premises networks via Direct Connect.

Full explanation →

646

MCQmedium

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The VPC uses a virtual private gateway (VGW). The on-premises network advertises a route to a specific subnet (10.0.0.0/24) via BGP. However, traffic from the VPC to that subnet is failing. What should the network engineer check first?

A.Verify that the customer gateway device is advertising the subnet route.

B.Verify that the virtual interface is in the 'available' state and BGP session is established.

C.Verify that the VGW is attached to the VPC.

D.Verify that route propagation is enabled on the VPC's route tables associated with the subnets.

AnswerD

Without route propagation, the BGP routes from Direct Connect are not added to the route tables.

Why this answer

The most common cause of traffic failure from a VPC to an on-premises subnet over Direct Connect is that the VPC route tables do not have a route for the on-premises subnet. Even if the VGW is attached and BGP is established, the VPC subnets must have route propagation enabled on their route tables to automatically learn the routes advertised by the on-premises network via BGP. Without this, the VPC has no path to send traffic to the 10.0.0.0/24 subnet.

Exam trap

The trap here is that candidates assume a working BGP session and VIF automatically make the route available in the VPC, overlooking the requirement for route propagation to be explicitly enabled on the VPC's subnet route tables.

How to eliminate wrong answers

Option A is wrong because the question states the on-premises network is already advertising the subnet route via BGP, so verifying the advertisement again is not the first step. Option B is wrong because while a healthy VIF and BGP session are necessary, they are not the first check when the issue is specifically that traffic from the VPC is failing; the VIF state and BGP session could be fine, but the VPC still lacks a route. Option C is wrong because the VGW must be attached for the Direct Connect connection to work at all, and the question implies the VPC is using a VGW, so this is likely already in place; checking attachment is a lower-priority step.

Full explanation →

647

MCQeasy

A company is using AWS WAF to protect its web application. The security team wants to block requests that contain SQL injection patterns. Which WAF rule type should be used?

A.SQL injection match condition

B.Geographic match rule

C.IP set rule

D.Rate-based rule

AnswerA

AWS WAF includes managed rule groups specifically for SQL injection detection.

Why this answer

AWS WAF provides a SQL injection match condition that inspects incoming requests for patterns indicative of SQL injection attacks. This condition can be used in a rule to block or allow requests. Option B is incorrect because geographic match rules block based on the geographic origin of the request, not SQL injection.

Option C is incorrect because IP set rules block based on source IP addresses. Option D is incorrect because rate-based rules limit the rate of requests from an IP, not detect SQL injection.

Full explanation →

648

MCQhard

A company is migrating a legacy application to AWS. The application requires multicast communication between instances. The company needs to implement a multicast solution within a VPC. Which AWS service or feature should be used to support multicast?

A.Create a Transit Gateway multicast domain

B.Configure multicast in the VPC's route tables

C.Use AWS Global Accelerator for multicast distribution

D.Set up VPC peering to enable multicast between subnets

AnswerA

Transit Gateway supports multicast groups and can distribute multicast traffic.

Why this answer

AWS Transit Gateway supports multicast through the creation of a Transit Gateway multicast domain. This feature allows you to send multicast traffic from a source to multiple receivers within a VPC, which is required for legacy applications that rely on multicast communication. Transit Gateway multicast domains work with IGMP (Internet Group Management Protocol) to manage group memberships and route multicast traffic efficiently.

Exam trap

The ANS-C01 exam often tests the misconception that VPC route tables or VPC peering can handle multicast, but AWS explicitly does not support multicast natively in VPCs, requiring Transit Gateway multicast domains as the only scalable solution.

How to eliminate wrong answers

Option B is wrong because VPC route tables do not support multicast forwarding; they only handle unicast traffic and do not have the capability to replicate packets to multiple destinations. Option C is wrong because AWS Global Accelerator is designed for unicast traffic optimization using Anycast IPs and does not support multicast distribution or group communication. Option D is wrong because VPC peering does not support multicast traffic; it only allows unicast communication between VPCs and does not forward multicast or broadcast packets.

Full explanation →

649

MCQeasy

A network engineer is troubleshooting intermittent connectivity issues between an EC2 instance in a VPC and an on-premises data center over a Direct Connect virtual interface. The engineer notices that the BGP session is flapping. Which configuration should the engineer verify first?

A.Verify that the BGP hold timer and keepalive interval are consistent between the on-premises router and the AWS side.

B.Verify that the MTU setting on the Direct Connect virtual interface matches the on-premises router.

C.Verify that the on-premises router is advertising the correct prefix to AWS.

D.Verify that the Direct Connect virtual interface is in the 'available' state.

AnswerA

BGP timer mismatch causes session flapping.

Why this answer

BGP session flapping is often caused by mismatched BGP timers (hold timer and keepalive interval) between BGP peers. Verifying that these timers are consistent should be the first step. Option B is incorrect because MTU mismatch typically leads to packet loss or fragmentation, not BGP flapping.

Option C is incorrect because advertising the correct prefix is necessary for route propagation, but BGP session stability depends on timer and configuration compatibility. Option D is incorrect because the virtual interface state being 'available' is a prerequisite, but if it is available, flapping suggests a higher-layer configuration issue.

Full explanation →

650

Multi-Selecthard

A company is using AWS Transit Gateway to connect multiple VPCs and Direct Connect. The network team wants to monitor network performance and detect anomalies. Which THREE AWS services should the team use together to achieve this goal? (Select THREE.)

Select 3 answers

A.Amazon CloudWatch

B.AWS Trusted Advisor

C.AWS Network Manager

D.VPC Flow Logs

E.AWS X-Ray

AnswersA, C, D

For log aggregation and metric analysis.

Why this answer

Options A, C, and D are correct. A: Amazon CloudWatch collects metrics and logs from AWS resources, enabling monitoring and alarms for anomalies in network performance. C: AWS Network Manager provides a global view of Transit Gateway networks and performance metrics, helping detect anomalies across VPCs and Direct Connect.

D: VPC Flow Logs capture IP traffic information for analysis, aiding in anomaly detection. Option B is wrong because AWS Trusted Advisor offers best practice checks, not real-time network monitoring. Option E is wrong because AWS X-Ray is for application tracing, not network performance.

Full explanation →

651

MCQeasy

A company is using AWS Client VPN to provide remote access to their VPC. Users report that they can connect to the VPN but cannot reach any resources in the VPC. What is the most likely cause?

A.The authorization rules do not include the client's group.

B.The Client VPN endpoint does not have a subnet association.

C.The Client VPN endpoint security group does not allow inbound traffic from the client CIDR.

D.The client's VPN software is not configured with the correct DNS server.

AnswerB

Correct. Without a subnet association, the Client VPN endpoint cannot route traffic to the VPC, causing the inability to reach any resources even though the VPN connection is established.

Why this answer

If users can connect to the VPN but cannot reach resources in the VPC, the most likely cause is that the Client VPN endpoint lacks a subnet association. Without a subnet association, the endpoint cannot route traffic to the VPC. Option A is incorrect because authorization rules control which users can access specific resources, but the issue is broader connectivity.

Option C is incorrect because the security group controls inbound traffic to the endpoint, but the connection itself works; the problem is routing. Option D is incorrect because DNS configuration affects name resolution, not basic IP reachability.

Full explanation →

652

MCQhard

A company runs a multi-tier application on AWS. The web tier consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application tier runs on EC2 instances in a separate Auto Scaling group, and the database tier uses an Amazon RDS MySQL instance. All resources are in the same VPC. The security team has identified that the application tier instances are receiving traffic from unknown IP addresses on port 22 (SSH). The team wants to ensure that only the web tier instances can communicate with the application tier on the application port (8080), and only from a specific security group. Additionally, the database tier should only accept traffic from the application tier on port 3306. Currently, the security groups are configured as follows: Web-SG allows inbound from 0.0.0.0/0 on ports 80 and 443; App-SG allows inbound from 0.0.0.0/0 on port 8080 and from 0.0.0.0/0 on port 22; DB-SG allows inbound from 0.0.0.0/0 on port 3306. The team has also noticed that the web tier instances can be accessed via SSH from the internet. Which course of action should the team take to remediate the security issues?

A.Update Web-SG to allow SSH from a specific management CIDR. Leave App-SG and DB-SG as is because they are not directly accessible from the internet.

B.Remove inbound SSH rules from all security groups and rely on AWS Systems Manager Session Manager for administrative access.

C.Update Web-SG to allow SSH from a specific management CIDR. Update App-SG to allow inbound on port 8080 from Web-SG only, and remove inbound SSH from App-SG (or restrict to management CIDR). Update DB-SG to allow inbound on port 3306 from App-SG only.

D.Use network ACLs on the subnets to restrict traffic between tiers instead of security groups.

AnswerC

This properly restricts traffic to only necessary sources and removes open SSH access.

Why this answer

This option comprehensively addresses the security issues: restrict SSH access to the web tier from a trusted management CIDR, limit application tier access (port 8080) to only the web tier security group, and restrict database access (port 3306) to only the application tier security group. Additionally, it removes the overly permissive SSH rule on the application tier or restricts it to a management CIDR. Option A is insufficient because it leaves App-SG and DB-SG open to the internet on their respective ports.

Option B removes SSH entirely, which may be needed for management, and does not address application traffic restrictions between tiers. Option D suggests using network ACLs, which are stateless and more complex; security groups are stateful and more appropriate for this use case.

Full explanation →

653

MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has a NAT gateway in the public subnet. The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT gateway. However, the EC2 instance cannot reach the internet. Which additional configuration is needed?

A.Assign a public IP address to the EC2 instance.

B.Attach a security group to the NAT gateway allowing outbound traffic.

C.Add a route to the NAT gateway in the private subnet's route table for destination 0.0.0.0/0.

D.Ensure the public subnet's route table has a route 0.0.0.0/0 pointing to an internet gateway.

AnswerD

The NAT gateway needs internet access via the internet gateway.

Why this answer

The NAT gateway resides in the public subnet, but it still needs a route to the internet. The public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway (IGW) so that traffic from the NAT gateway can be forwarded to the internet. Without this route, the NAT gateway cannot send traffic beyond the VPC, even though the private subnet's route table correctly points to the NAT gateway.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT gateway automatically has internet access just because it is in a public subnet, but the public subnet itself must have a route to an internet gateway for the NAT gateway to function.

How to eliminate wrong answers

Option A is wrong because assigning a public IP to the EC2 instance in a private subnet does not enable internet access; the instance would still need a route through an internet gateway, and private subnets typically do not have direct IGW routes. Option B is wrong because security groups for NAT gateways are not supported; NAT gateways use network ACLs and security groups are not attached to them. Option C is wrong because the private subnet's route table already has a 0.0.0.0/0 route pointing to the NAT gateway, as stated in the question; adding it again would be redundant and does not solve the missing IGW route in the public subnet.

Full explanation →

654

MCQmedium

A company is designing a network architecture for a two-tier web application. The web tier runs on EC2 instances behind an Application Load Balancer (ALB) in public subnets. The application tier runs on EC2 instances in private subnets. The application tier needs to access an Amazon RDS for PostgreSQL database in the same private subnets. The company requires that all traffic between the ALB and web tier, as well as between web tier and application tier, remain within the AWS network and not traverse the internet. The current design uses an Internet Gateway (IGW) for public subnet internet access and a NAT Gateway for private subnet outbound internet access. The web tier instances have a default route to the IGW, and the application tier instances have a default route to the NAT Gateway. The security groups are configured correctly. However, the application tier cannot connect to the RDS database. What is the MOST likely cause?

A.The application tier instances are using the RDS public DNS name instead of the private DNS name

B.The RDS database is in a different VPC

C.The ALB is not configured to forward traffic to the web tier

D.The NAT Gateway is not configured with the correct route to the RDS subnet

AnswerA

Using the public endpoint causes traffic to go to the NAT Gateway, which cannot connect to RDS's public endpoint from private subnet without proper routing.

Why this answer

The RDS database is in private subnets. The application tier instances are also in private subnets. They should be able to communicate within the same VPC via private IP addresses.

The issue is not about internet access. The most likely cause is that the application tier instances are trying to connect to the RDS endpoint using the public DNS name, which resolves to a public IP, and the traffic is being routed to the NAT Gateway, which blocks inbound traffic from the internet (the RDS public endpoint). The application tier should use the private DNS name or the private IP address of the RDS instance.

Alternatively, the security group might be misconfigured, but the question says security groups are correct. The most common mistake is using the public endpoint.

Full explanation →

655

MCQhard

A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The security team needs to centralize inspection of all traffic between VPCs using a third-party firewall appliance in a shared services VPC. What is the most scalable and highly available design?

A.Use VPC peering to connect all VPCs to the shared services VPC and route traffic through the firewall.

B.Create a Transit Gateway with separate route tables for each VPC and a shared route table for the inspection VPC. Use Gateway Load Balancer to distribute traffic to a fleet of firewall instances.

C.Attach all VPCs to a Transit Gateway and configure a Network Load Balancer in the shared services VPC to distribute traffic to firewall instances.

D.Attach all VPCs to a Transit Gateway and use a single firewall instance with elastic network interfaces in each VPC.

AnswerB

This design is scalable and highly available, with Gateway Load Balancer for inspection and Transit Gateway for routing.

Why this answer

It combines AWS Transit Gateway with separate route tables per VPC and a shared inspection route table, enabling centralized traffic steering to a fleet of firewall instances behind a Gateway Load Balancer (GWLB). GWLB transparently distributes traffic across multiple firewall instances at the network layer (GENEVE protocol), providing both horizontal scalability and high availability without introducing a single point of failure or requiring complex VPC peering meshes.

Exam trap

The trap here is that candidates often confuse Network Load Balancer (NLB) with Gateway Load Balancer (GWLB), assuming NLB can transparently inspect traffic, but GWLB is the only AWS load balancer designed for inline traffic inspection with third-party appliances.

How to eliminate wrong answers

Option A is wrong because VPC peering creates a full mesh of point-to-point connections that does not scale beyond a few VPCs, and it lacks centralized route control, forcing all traffic through a single firewall in the shared services VPC without built-in load balancing or failover. Option C is wrong because a Network Load Balancer (NLB) operates at Layer 4 and cannot transparently intercept traffic for stateful inspection without additional configuration (e.g., proxy or NAT), whereas GWLB is designed specifically for transparent traffic inspection using GENEVE encapsulation. Option D is wrong because a single firewall instance with elastic network interfaces (ENIs) in each VPC creates a brittle, non-scalable architecture with a single point of failure and no load balancing, violating high availability and scalability requirements.

Full explanation →

656

MCQeasy

A solutions architect needs to design a VPC with both IPv4 and IPv6 support. The VPC will have public and private subnets. Resources in private subnets need outbound IPv6 access to the internet. Which combination of resources should be used?

A.Internet gateway for public subnets and VPC gateway endpoints for private subnets

B.Internet gateway for public subnets and NAT gateway for private subnets

C.Internet gateway for both public and private subnets using route tables

D.Internet gateway for public subnets and egress-only internet gateway for private subnets

AnswerD

Egress-only internet gateway provides IPv6 outbound access for private subnets.

Why this answer

An egress-only internet gateway (EIGW) is the AWS-managed service designed specifically to provide outbound-only IPv6 access from private subnets to the internet, while an internet gateway (IGW) handles both inbound and outbound IPv4/IPv6 traffic for public subnets. Unlike a NAT gateway, which only supports IPv4, the EIGW works with IPv6 and prevents any inbound IPv6 connections from the internet, meeting the requirement for outbound-only IPv6 access.

Exam trap

AWS often tests the misconception that a NAT gateway can handle IPv6 traffic, but NAT gateways are IPv4-only; the trap here is confusing the IPv4 outbound solution (NAT gateway) with the IPv6 outbound solution (egress-only internet gateway), or assuming an internet gateway can be used in private subnets with route restrictions.

How to eliminate wrong answers

Option A is wrong because VPC gateway endpoints (e.g., S3, DynamoDB) provide private connectivity to AWS services, not general outbound internet access, and they do not support IPv6 traffic. Option B is wrong because a NAT gateway only supports IPv4 traffic and cannot provide outbound IPv6 access; it is used for IPv4 private subnet internet access. Option C is wrong because placing an internet gateway in private subnet route tables would allow inbound internet traffic (both IPv4 and IPv6) to those subnets, violating the requirement for private subnets that must not be directly reachable from the internet.

Full explanation →

657

MCQeasy

A company is deploying a new VPC with public and private subnets. The company wants to ensure that EC2 instances in the private subnet can access the internet for software updates. The instances do not need to be accessible from the internet. The network engineer has created a NAT gateway in the public subnet and added a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. However, instances in the private subnet cannot reach the internet. The NAT gateway is in the 'available' state. What is the MOST likely cause?

A.The NAT gateway is not in a public subnet.

B.The NAT gateway does not have an Elastic IP address associated.

C.The private subnet's route table does not have a default route to the NAT gateway.

D.The security group of the EC2 instances blocks outbound traffic.

AnswerB

NAT gateway requires an EIP for internet access.

Why this answer

An Elastic IP must be associated with the NAT gateway for it to work. Option A is incorrect because the NAT gateway is already in a public subnet. Option C is incorrect because the route is present.

Option D is incorrect because security groups do not block outbound traffic to internet by default.

Full explanation →

658

MCQeasy

A company wants to audit all network traffic to and from EC2 instances for security analysis. Which AWS service should they enable?

A.VPC Flow Logs

B.Amazon GuardDuty

C.AWS CloudTrail

D.AWS Config

AnswerA

VPC Flow Logs capture information about IP traffic to and from network interfaces.

Why this answer

VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC, making them the correct choice for auditing network traffic. Option A is correct. AWS CloudTrail records API calls, not network traffic.

AWS Config records resource configuration changes. Amazon GuardDuty analyzes logs and flows for threats, but it does not capture the raw traffic itself.

Full explanation →

659

MCQhard

A company has a VPC with CIDR 10.0.0.0/16. They have public subnets (10.0.1.0/24, 10.0.2.0/24) and private subnets (10.0.3.0/24, 10.0.4.0/24) in two Availability Zones. An Internet Gateway is attached to the VPC, and a NAT Gateway is in public subnet 10.0.1.0/24. The private subnets route 0.0.0.0/0 to the NAT Gateway. The security team notices that instances in private subnet 10.0.3.0/24 can reach the internet, but instances in private subnet 10.0.4.0/24 cannot. Both private subnets have the same route table configuration. The network ACLs for both private subnets are set to allow all inbound and outbound traffic. What is the most likely cause of the issue?

A.The route table for the public subnet 10.0.1.0/24 does not have a route to the Internet Gateway.

B.The security group on the instances in private subnet 10.0.4.0/24 is blocking outbound traffic.

C.The network ACL for private subnet 10.0.4.0/24 is blocking outbound traffic.

D.The route table for private subnet 10.0.4.0/24 does not have a route to the NAT Gateway.

AnswerA

The NAT Gateway needs a route to the Internet Gateway through its subnet's route table.

Why this answer

The NAT Gateway is in the public subnet 10.0.1.0/24. For the NAT Gateway to reach the internet, the route table associated with that public subnet must have a default route (0.0.0.0/0) pointing to the Internet Gateway. Without this route, the NAT Gateway cannot forward traffic from private subnets to the internet.

Since both private subnets have the same route table configuration pointing to the NAT Gateway, the issue is isolated to the NAT Gateway's inability to reach the internet due to the missing route in the public subnet's route table. Options B, C, and D are incorrect: security groups and network ACLs are configured to allow traffic, and the private subnet route tables are correctly set to route to the NAT Gateway.

Full explanation →

660

Drag & Dropmedium

Arrange the steps to configure an AWS Transit Gateway with attachments to multiple VPCs:

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First create the transit gateway, then create attachments, associate them with a route table, update VPC routes, and test connectivity.

Full explanation →

661

MCQeasy

A company needs to establish a dedicated, private, high-bandwidth connection between its on-premises data center and AWS. Which AWS service should be used?

A.AWS Direct Connect

B.AWS Transit Gateway

C.AWS Site-to-Site VPN

D.VPC peering

AnswerA

Dedicated private connection.

Why this answer

AWS Direct Connect is the correct service because it provides a dedicated, private, high-bandwidth network connection from an on-premises data center to AWS, bypassing the public internet. This is achieved through a physical cross-connect at an AWS Direct Connect location, delivering consistent latency and higher throughput compared to internet-based connections.

Exam trap

The ANS-C01 exam often tests the misconception that AWS Site-to-Site VPN provides a private, dedicated connection, but it actually runs over the public internet and cannot match the bandwidth or consistency of Direct Connect.

How to eliminate wrong answers

Option B (AWS Transit Gateway) is wrong because it is a network transit hub that interconnects VPCs and on-premises networks via VPN or Direct Connect, but it does not itself provide a dedicated physical connection; it relies on another connectivity method. Option C (AWS Site-to-Site VPN) is wrong because it uses the public internet over IPsec tunnels, which cannot guarantee dedicated, private, high-bandwidth performance due to variable internet conditions and lack of physical isolation. Option D (VPC peering) is wrong because it connects only VPCs within AWS and cannot extend to an on-premises data center; it is a logical connection using AWS internal infrastructure, not a dedicated physical link.

Full explanation →

662

MCQhard

A company's security team notices that a VPC flow log record shows an outbound connection from a private EC2 instance to an IP address in a restricted country. The security group allows outbound 0.0.0.0/0 for TCP 443. The network ACL allows outbound traffic to 0.0.0.0/0 on ephemeral ports. The company uses AWS Network Firewall with a firewall policy that has a stateful rule group that denies traffic to the restricted country. The flow log shows the traffic was accepted. What is the most likely cause?

A.VPC Flow Logs are not capturing all traffic.

B.The subnet's route table does not have a route that sends traffic to the AWS Network Firewall endpoint.

C.The network ACL inbound rule blocks the return traffic.

D.The security group outbound rule is not configured correctly.

AnswerB

If the route table does not point to the firewall, traffic bypasses the firewall and the stateful rule is not evaluated.

Why this answer

AWS Network Firewall's stateful rules are only evaluated for traffic that is routed through the firewall endpoint. If the subnet's route table does not include a route directing traffic to the firewall endpoint, the traffic bypasses the firewall entirely, allowing the outbound connection even though the firewall policy denies it. Option A is incorrect because VPC Flow Logs capture all accepted and rejected traffic after security group and NACL evaluation.

Option C is incorrect because the network ACL allows outbound traffic on ephemeral ports, so inbound return traffic is permitted by the default ephemeral port rule. Option D is incorrect because the security group explicitly allows outbound HTTPS (TCP 443) to 0.0.0.0/0, which is permissive.

Full explanation →

663

MCQeasy

A company has a VPC with a CIDR of 10.0.0.0/16. They want to connect this VPC to a second VPC with CIDR 10.1.0.0/16 using VPC Peering. The VPCs are in the same account and Region. What is the minimum number of route table entries needed in each VPC to enable full bidirectional communication?

A.Two routes in each VPC's route table: one for the local CIDR and one for the peer CIDR

B.No routes are needed because VPC Peering automatically enables communication

C.One route in each VPC's route table

D.One route in only one VPC's route table

AnswerC

Each VPC needs a route to the peer VPC's CIDR via the peering connection.

Why this answer

VPC peering requires a route in each VPC's route table pointing to the CIDR of the peer VPC, using the peering connection as the target. The local VPC's CIDR is automatically added to the route table by default, so only one additional route per VPC is needed for full bidirectional communication.

Exam trap

The trap here is that candidates assume VPC peering automatically handles routing, similar to a VPN or direct connect, but AWS requires explicit route table entries for each direction.

How to eliminate wrong answers

Option A is wrong because the local CIDR is already present in each VPC's route table by default; adding a second route for the local CIDR is unnecessary. Option B is wrong because VPC peering does not automatically add routes; you must manually add routes to enable traffic flow between the VPCs. Option D is wrong because both VPCs need a route to the peer CIDR; adding a route in only one VPC would allow only unidirectional traffic.

Full explanation →

664

MCQeasy

A company is designing a VPC with public and private subnets. The private subnets need to access the internet for software updates but must not be directly accessible from the internet. Which AWS service should be used to provide internet access to instances in the private subnets?

A.Internet gateway

B.NAT gateway

C.VPC endpoint

D.Transit gateway

AnswerB

NAT gateway provides outbound-only internet access for private subnets.

Why this answer

A NAT gateway enables instances in a private subnet to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound traffic from the internet. It translates the private IP addresses of the instances to the NAT gateway's Elastic IP address using source network address translation (SNAT), and it does not maintain state for inbound connections that were not initiated from within the VPC.

Exam trap

The ANS-C01 exam often tests the misconception that an internet gateway can be used in a private subnet by simply not assigning public IPs, but the trap is that an internet gateway requires the subnet to have a route to it and instances must have public IPs for return traffic to work, which would expose them to inbound internet traffic.

How to eliminate wrong answers

Option A is wrong because an internet gateway allows bidirectional communication between the VPC and the internet; attaching it to a private subnet would make instances directly accessible from the internet, violating the requirement. Option C is wrong because a VPC endpoint provides private connectivity to AWS services (e.g., S3, DynamoDB) over the AWS network, not general internet access for software updates. Option D is wrong because a transit gateway is used to interconnect VPCs and on-premises networks via a central hub; it does not provide internet access to instances in a private subnet.

Full explanation →

665

MCQeasy

A company wants to securely connect two VPCs in different AWS regions using AWS infrastructure. Which service should be used?

A.AWS Direct Connect

B.Internet Gateway

C.VPC peering

D.AWS Transit Gateway

AnswerC

VPC peering supports inter-region connections.

Why this answer

VPC peering is the correct service because it allows direct, private connectivity between two VPCs in different AWS regions using AWS's internal network, without traversing the public internet. It uses the existing AWS infrastructure to route traffic between the VPCs via private IP addresses, and it supports inter-region peering as of 2017, making it the simplest and most cost-effective solution for this specific requirement.

Exam trap

The trap here is that candidates often choose AWS Transit Gateway because they think it is required for inter-region connectivity, but they overlook that VPC peering directly supports cross-region connections and is the simpler, more cost-effective option for a two-VPC scenario.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated physical connection from an on-premises data center to AWS, not a service for connecting two VPCs across regions. Option B is wrong because an Internet Gateway provides internet access to a VPC and does not create private connectivity between VPCs; traffic would flow over the public internet, violating the security requirement. Option D is wrong because AWS Transit Gateway is designed for hub-and-spoke connectivity among many VPCs and on-premises networks, but it does not natively support inter-region peering without additional components like a Transit Gateway peering attachment, making it overly complex and not the direct service for a simple two-VPC inter-region connection.

Full explanation →

666

MCQmedium

A company is using AWS Transit Gateway to connect multiple VPCs. The security team wants to inspect all traffic between VPCs with a third-party firewall appliance deployed in a centralized inspection VPC. What is the MOST efficient way to route traffic to the inspection VPC?

A.Create VPC peering connections between all VPCs and route traffic through the inspection VPC.

B.Use AWS PrivateLink to route traffic through the inspection VPC.

C.Configure Transit Gateway route tables with a blackhole route for the inter-VPC traffic and a route pointing to the inspection VPC.

D.Attach a Network Load Balancer in each VPC and route traffic through it.

AnswerC

This allows traffic between VPCs to be forced through the inspection VPC for firewall inspection.

Why this answer

By configuring Transit Gateway route tables with a blackhole route for inter-VPC traffic and a more specific route pointing to the inspection VPC, traffic between VPCs is forced to go through the inspection VPC for firewall inspection. Option A is wrong because VPC peering does not support transitive routing and would require full mesh. Option B is wrong because AWS PrivateLink is used for private connectivity to services, not for routing traffic between VPCs.

Option D is wrong because a Network Load Balancer is not designed for traffic inspection and would add unnecessary complexity.

Full explanation →

667

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). They launch a NAT Gateway in the public subnet and add a route in the private subnet route table: destination 0.0.0.0/0, target nat-gateway-id. An EC2 instance in the private subnet can ping an external server, but cannot connect to it via SSH. The security group allows outbound SSH (port 22), and the NACL allows outbound ephemeral ports. What is the likely cause?

A.The NACL on the private subnet is blocking outbound ephemeral ports.

B.The route table in the private subnet does not have a route to the NAT Gateway.

C.The external server's firewall is blocking traffic from the NAT Gateway's Elastic IP address.

D.The NAT Gateway is not configured to allow SSH traffic.

AnswerC

The external server must allow the NAT Gateway's public IP on port 22.

Why this answer

The NAT Gateway translates the private instance's source IP to its own Elastic IP address for outbound traffic. SSH connections require bidirectional communication: the external server must send SYN-ACK packets back to the source IP. If the external server's firewall blocks traffic from the NAT Gateway's Elastic IP, the TCP handshake fails, preventing SSH while ICMP (ping) may still work because ICMP echo requests and replies are stateless and often allowed by default.

Exam trap

The trap here is that candidates assume SSH failure must be due to a missing route or security group misconfiguration, but the real issue is that the external server's firewall is blocking return traffic from the NAT Gateway's Elastic IP, which is a common real-world scenario when the external server has IP-based allowlists.

How to eliminate wrong answers

Option A is wrong because the question explicitly states the NACL allows outbound ephemeral ports, so it is not blocking outbound traffic. Option B is wrong because the question states a route to the NAT Gateway (0.0.0.0/0 -> nat-gateway-id) is already added to the private subnet route table. Option D is wrong because a NAT Gateway operates at Layer 3/4 and does not inspect or filter traffic by protocol or port; it simply forwards packets based on stateful translation, so it does not have a concept of 'allowing SSH'.

Full explanation →

668

Multi-Selectmedium

Which TWO statements about AWS Transit Gateway are correct? (Choose two.)

Select 2 answers

A.It provides internet access for attached VPCs

B.It supports transitive routing between attached VPCs

C.It can be shared across AWS accounts using AWS Resource Access Manager

D.It can replace AWS Direct Connect for on-premises connectivity

E.It only supports VPN attachments

AnswersB, C

Transit Gateway allows VPCs to communicate through it.

Why this answer

AWS Transit Gateway (TGW) acts as a central hub that enables transitive routing between all attached VPCs. When you attach multiple VPCs to the same TGW, their route tables are configured to point to the TGW, allowing traffic to flow from one VPC to another through the hub without needing individual VPC peering connections. This transitive behavior is a core feature of TGW, simplifying network architecture and reducing the number of routing paths required.

Exam trap

The ANS-C01 exam often tests the misconception that Transit Gateway provides internet access or replaces Direct Connect, but in reality, TGW is a hub for private routing and requires separate components (IGW, NAT, Direct Connect) for internet or dedicated on-premises connectivity.

Full explanation →

669

MCQeasy

A company is setting up a VPC with both public and private subnets. The private subnets need outbound internet access for software updates. Which component is required to enable this?

A.A NAT gateway in a public subnet.

B.A VPN connection to an on-premises network that has internet access.

C.A VPC peering connection to a VPC that has internet access.

D.An internet gateway attached to the VPC with a route in the private subnet's route table pointing to the internet gateway.

AnswerA

NAT gateway enables outbound internet for private subnets.

Why this answer

A NAT gateway in a public subnet is required to enable outbound internet access for private subnets. The NAT gateway resides in a public subnet with an Internet Gateway (IGW) route, and private subnet route tables direct default traffic (0.0.0.0/0) to the NAT gateway's elastic network interface. This allows instances in private subnets to initiate outbound connections (e.g., for software updates) while preventing unsolicited inbound traffic from the internet.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with an Internet Gateway, thinking a direct IGW route in the private subnet is acceptable, or they mistakenly believe VPC peering or VPN can provide transitive internet access without additional configuration.

How to eliminate wrong answers

Option B is wrong because a VPN connection to an on-premises network that has internet access does not provide direct outbound internet access from the VPC; it only routes traffic to the on-premises network, which would require additional NAT or proxy configuration and introduces latency and dependency on the on-premises internet link. Option C is wrong because a VPC peering connection does not enable transitive internet access; even if the peered VPC has an IGW, the peering connection does not allow traffic from one VPC to use the other VPC's IGW (no transitive routing). Option D is wrong because an Internet Gateway attached to the VPC with a route in the private subnet's route table pointing to the IGW would directly expose private instances to the internet, violating the security model of a private subnet; private subnets must not have a direct IGW route.

Full explanation →

670

Multi-Selectmedium

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The network team wants to isolate traffic between VPCs while allowing all VPCs to reach the on-premises network. Which TWO configurations should be implemented?

Select 2 answers

A.Attach the Direct Connect virtual interface to a VPN attachment on the Transit Gateway

B.Use a Direct Connect gateway to propagate routes to all VPCs

C.Create separate Transit Gateway route tables for each VPC and associate them with the respective VPC attachments

D.Use a single Transit Gateway route table for all attachments

E.Create VPC peering connections between each VPC

AnswersB, C

Using a Direct Connect gateway to propagate routes to all VPCs is not a valid configuration for Transit Gateway. The Direct Connect gateway associates with the Transit Gateway, not directly with VPCs.

Why this answer

Creating separate Transit Gateway route tables for each VPC and associating them with the respective VPC attachments enforces traffic isolation between VPCs: each VPC route table only contains routes to the on-premises network, not to other VPCs, thus achieving the isolation requirement. Additionally, using a Direct Connect gateway to propagate routes to all VPCs ensures that the on-premises network routes are available in these isolated route tables. Option A is incorrect because a Direct Connect virtual interface must be attached to a Direct Connect Gateway, which then associates with the Transit Gateway via a transit gateway attachment.

A VPN attachment is for VPN connections, not Direct Connect. Option D is incorrect because a single Transit Gateway route table for all attachments would allow VPC-to-VPC communication via automatically propagated routes. Option E is incorrect because VPC peering connections would create direct connectivity between VPCs, violating the isolation requirement.

Exam trap

The trap here is thinking that a single route table can isolate VPC traffic or that a Direct Connect virtual interface attaches directly to a Transit Gateway VPN attachment. In reality, separate route tables per VPC combined with route propagation from a Direct Connect gateway are needed to isolate VPCs while providing shared on-premises access.

Full explanation →

671

MCQhard

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking a suboptimal path, going through the on-premises network instead of staying within AWS. What is the most likely cause?

A.The Transit Gateway route table has a propagated route from the on-premises network with a longer prefix

B.The VPCs are also peered directly, creating a conflict

C.VPC Flow Logs are enabled, causing latency

D.Security groups are blocking direct traffic between VPCs

AnswerA

More specific routes override default routes, sending traffic on-premises.

Why this answer

When a Transit Gateway route table contains a propagated route from an on-premises network with a longer prefix (more specific) than the local VPC route, traffic destined for that specific CIDR will be sent to the on-premises network instead of using the inter-VPC route. This is because more specific routes take precedence over less specific ones. The suboptimal path occurs because the traffic is forced through the on-premises network, even though both VPCs are attached to the Transit Gateway and could communicate directly within AWS.

Option A is correct. Option B is incorrect because VPC peering is not used with Transit Gateway; if peering existed, it could create route conflicts, but the scenario describes Transit Gateway. Option C is incorrect because VPC Flow Logs are for monitoring traffic and do not affect routing.

Option D is incorrect because security groups are stateful firewalls that control traffic, but they do not determine routing paths; routing is controlled by route tables.

Full explanation →

672

MCQeasy

A company needs to provide internet access to instances in a private subnet while preventing inbound connections from the internet. Which AWS service should be used?

A.NAT Gateway

B.Internet Gateway

C.AWS Direct Connect

D.VPC Endpoint

AnswerA

Provides outbound only.

Why this answer

A NAT Gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. It achieves this by translating the private source IP addresses of the instances to the NAT Gateway's Elastic IP address, and by default it does not allow inbound traffic unless an explicit inbound rule is added to the associated route table, which is not recommended for this use case.

Exam trap

AWS often tests the misconception that an Internet Gateway can be used in a private subnet with restrictive security groups or network ACLs, but the trap is that an Internet Gateway inherently allows bidirectional traffic and cannot prevent unsolicited inbound connections at the gateway level, whereas a NAT Gateway is specifically designed for outbound-only internet access.

How to eliminate wrong answers

Option B (Internet Gateway) is wrong because an Internet Gateway allows both outbound and inbound traffic from the internet; attaching it to a private subnet would expose instances to unsolicited inbound connections, violating the requirement. Option C (AWS Direct Connect) is wrong because it establishes a dedicated private network connection from on-premises to AWS, not internet access, and does not inherently provide internet connectivity or block inbound internet traffic. Option D (VPC Endpoint) is wrong because it provides private connectivity to AWS services (e.g., S3, DynamoDB) over the AWS network without traversing the internet, but it does not provide general internet access for instances.

Full explanation →

673

Multi-Selectmedium

A company is designing a network for a multi-tier application that must meet compliance requirements. The architecture includes a VPC with public, private, and database subnets. Which TWO actions should be taken to ensure the database subnets are not directly accessible from the internet? (Select TWO.)

Select 2 answers

A.Attach an Internet Gateway to the database subnets.

B.Create a NAT Gateway in the database subnets.

C.Associate a security group that denies inbound traffic from 0.0.0.0/0.

D.Configure a network ACL on the database subnets to deny inbound traffic from 0.0.0.0/0.

E.Place the database subnets in private subnets.

AnswersD, E

Correct: Network ACLs can deny inbound traffic.

Why this answer

A network ACL (NACL) is a stateless firewall that operates at the subnet level. By configuring a NACL rule to deny inbound traffic from 0.0.0.0/0, you explicitly block all internet-originated traffic from reaching the database subnets, regardless of any security group rules. Option E is correct because placing the database subnets in private subnets means they have no direct route to an Internet Gateway, making them inherently inaccessible from the internet.

Exam trap

The ANS-C01 exam often tests the misconception that a security group deny rule can block inbound traffic from 0.0.0.0/0, but security groups only support allow rules and are stateful, so the correct approach is to use a network ACL deny rule or place the subnets in a private subnet without an Internet Gateway route.

Full explanation →

674

MCQhard

A media company runs a latency-sensitive streaming application on Amazon EC2 instances in a VPC. The application sends UDP traffic to multiple on-premises destinations via an AWS Transit Gateway with a VPN attachment. Users report occasional freezing. Network monitoring shows no packet loss on the VPN tunnel, but the application logs show out-of-order packets and high jitter. The company uses a single VPN tunnel with BGP dynamic routing over the public internet. The on-premises router has a 50ms latency to the AWS endpoint. The application requires low jitter and in-order delivery. What should a network engineer do to resolve the issue?

A.Add a second VPN tunnel to the same Transit Gateway to load balance traffic

B.Enable jumbo frames on the VPN tunnel to reduce packet overhead

C.Replace the VPN attachment with an AWS Direct Connect private VIF to provide a consistent path

D.Change the application to use TCP instead of UDP

AnswerC

Direct Connect provides consistent low latency and jitter.

Why this answer

UDP traffic over a single VPN tunnel over the internet can experience jitter and reordering due to variable network conditions. Using AWS Direct Connect provides a consistent, low-latency path that eliminates internet variability. Option A (multiple VPN tunnels) may not resolve jitter inherent to internet transit.

Option B (TCP instead of UDP) changes application protocol, not a network solution. Option D (enable jumbo frames) does not address jitter.

Full explanation →

675

Multi-Selectmedium

A company is designing a network security architecture for a multi-account environment using AWS Organizations. Which TWO services can be used to centrally manage security policies across all accounts?

Select 2 answers

A.AWS Config

B.AWS CloudTrail

C.AWS Organizations Service Control Policies (SCPs)

D.AWS Firewall Manager

E.Amazon VPC

AnswersC, D

SCPs centrally control permissions across accounts.

Why this answer

AWS Firewall Manager provides centralized management of firewall rules (including AWS WAF, AWS Shield Advanced, and security groups) across all accounts in AWS Organizations. AWS Organizations Service Control Policies (SCPs) allow you to centrally define and enforce permission boundaries and security policies across all member accounts. In contrast, AWS Config and AWS CloudTrail operate per account and do not provide centralized policy management across multiple accounts.

Amazon VPC is a per-account networking service. Therefore, the correct answers are C (SCPs) and D (Firewall Manager).

Full explanation →

Page 9 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and Operations Network Security, Compliance and Governance Network Design Network Implementation

See all domains with question counts →