CCNA Network Design Questions — Page 2 of 7

Multi-Selecthard

A company has a Direct Connect connection with a private VIF to a VPC. They want to add a second Direct Connect connection for redundancy. Both connections will terminate at the same Direct Connect gateway. Which TWO steps are required to enable BGP multipath (ECMP) across the two connections?

Select 2 answers

A.Ensure the same customer-side ASN is used on both virtual interfaces.

B.Use a different autonomous system number (ASN) on each virtual interface.

C.Advertise different BGP prefixes on each virtual interface.

D.Advertise the same BGP prefixes (routes) on both virtual interfaces.

E.Attach each virtual interface to a different VPC.

AnswersA, D

Same ASN is required for ECMP.

Why this answer

To enable BGP multipath (ECMP) across two Direct Connect connections terminating on the same Direct Connect gateway, you must use the same customer-side ASN on both virtual interfaces. This allows the Direct Connect gateway to treat both paths as equal-cost routes. Additionally, you must advertise the same BGP prefixes on both virtual interfaces so that the gateway sees identical routes from both paths and can load-balance traffic across them.

Exam trap

AWS often tests the misconception that using different ASNs or different prefixes is required for redundancy, but the key to ECMP is identical ASN and identical prefixes to enable equal-cost multipath routing.

Practice this question →

MCQhard

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to connect to an on-premises network via AWS Direct Connect. The on-premises network uses 10.0.0.0/16. Which solution allows connectivity without IP overlap?

A.Establish a VPC peering connection between the VPC and on-premises network.

B.Use AWS Direct Connect with a private VIF and static routes to route traffic.

C.Create a new VPC with a non-overlapping CIDR, connect both VPCs via Transit Gateway, and use NAT on the Transit Gateway attachment to the on-premises network.

D.Deploy a NAT instance in the VPC to translate on-premises IPs.

AnswerC

Transit Gateway with NAT attachment allows IP translation to resolve overlap.

Why this answer

When both the VPC and on-premises network use the same 10.0.0.0/16 CIDR, direct connectivity is impossible due to overlapping IP ranges. By creating a new VPC with a non-overlapping CIDR, connecting both VPCs via Transit Gateway, and applying NAT on the Transit Gateway attachment to the on-premises network, traffic from the original VPC can be source-NATed to the new VPC's range before being forwarded to on-premises, resolving the overlap. This allows the on-premises network to receive traffic with unique IPs, avoiding routing conflicts.

Exam trap

The ANS-C01 exam often tests the misconception that Direct Connect alone can handle overlapping IPs by using static routes or BGP communities, but without NAT or address translation, overlapping CIDRs cause asymmetric routing and unreachability.

How to eliminate wrong answers

Option A is wrong because VPC peering is used for connecting two VPCs within AWS, not for connecting a VPC to an on-premises network, and it cannot resolve IP overlap. Option B is wrong because Direct Connect with a private VIF and static routes does not address the IP overlap; if both sides use 10.0.0.0/16, routes will conflict and traffic will be unreachable. Option D is wrong because a NAT instance in the VPC translates on-premises IPs (destination NAT), but the fundamental issue is that the VPC and on-premises networks share the same CIDR, so return traffic from on-premises cannot be routed back correctly without also translating the VPC's source IPs, which a single NAT instance cannot fully resolve in a scalable manner.

Practice this question →

MCQhard

A company runs a critical application on EC2 instances in a VPC with a single private subnet (10.0.1.0/24) in us-east-1a. The instances need to download security updates from the internet. The company currently uses a NAT Gateway in a public subnet (10.0.0.0/24) in us-east-1a. Recently, an Availability Zone failure caused us-east-1a to become unavailable, and the application could not reach the internet. The company wants to redesign the network to be highly available across multiple AZs for internet access. The application must continue to use private IP addresses for outbound traffic. The company has a limited budget and wants to minimize costs while meeting high availability. Which solution should the company implement?

A.Deploy one NAT Gateway in a new public subnet in us-east-1b and update the private subnet route table to use it.

B.Remove the NAT Gateway and attach an internet gateway to the VPC. Add a route in the private subnet route table pointing 0.0.0.0/0 to the internet gateway.

C.Deploy a NAT Gateway in each of two AZs (us-east-1a and us-east-1b) in public subnets. Create private subnets in both AZs with separate route tables pointing to the local NAT Gateway.

D.Replace the NAT Gateway with a NAT instance in a public subnet in us-east-1a and configure a secondary ENI in us-east-1b for failover.

AnswerC

Multi-AZ NAT Gateways provide high availability with automatic failover.

Why this answer

It ensures high availability for outbound internet traffic by deploying a NAT Gateway in each of two Availability Zones (us-east-1a and us-east-1b) with separate private subnets and route tables. This design eliminates the single point of failure; if one AZ fails, the other NAT Gateway continues to route traffic. The application retains private IP addresses for outbound traffic, and the cost is minimized by using only two NAT Gateways (one per AZ) rather than a more expensive multi-AZ architecture like a transit gateway or VPN.

Exam trap

The trap here is that candidates often think a single NAT Gateway in a different AZ (Option A) provides high availability, but they miss that a NAT Gateway is AZ-scoped and cannot fail over to another AZ automatically, so a single NAT Gateway remains a single point of failure.

How to eliminate wrong answers

Option A is wrong because deploying a single NAT Gateway in us-east-1b still creates a single point of failure; if us-east-1b fails, internet access is lost. Option B is wrong because attaching an internet gateway directly to a private subnet would assign public IP addresses to the instances, violating the requirement to use private IP addresses for outbound traffic; internet gateways only work with public subnets and public IPs. Option D is wrong because using a NAT instance with a secondary ENI in another AZ for failover is more complex, less reliable (manual or scripted failover), and typically more expensive than managed NAT Gateways; NAT instances also require ongoing patching and management, contradicting the limited budget and high availability goals.

Practice this question →

MCQhard

The EC2 instance has a private IP 10.0.1.5. The first two hops are 10.0.1.1 (the subnet's default gateway) and 10.0.0.1. Based on the traceroute, what is the most likely configuration of the VPC?

A.The subnet is a public subnet with a route to an Internet Gateway

B.The subnet is a private subnet with no route to an Internet Gateway, and the default route points to a NAT instance or is missing

C.The subnet is a private subnet with a route to a NAT Gateway

D.The subnet is connected to a VPN

AnswerB

Traffic stops at VPC router, indicating no internet path.

Why this answer

The traceroute shows the first hop as 10.0.1.1 (the subnet's default gateway) and the second hop as 10.0.0.1 (the VPC router's IP for the main route table). The absence of a third hop to a public IP or NAT device indicates that the instance's traffic is not being forwarded beyond the VPC router. This is consistent with a private subnet that has no route to an Internet Gateway and either has no default route or a default route pointing to a NAT instance that is not responding or is missing, causing the traceroute to stop at the VPC router.

Exam trap

The trap here is that candidates often assume a private subnet must have a NAT Gateway or NAT instance for outbound traffic, but the traceroute's lack of a third hop indicates that either no NAT device exists or the default route is missing entirely, not that a NAT device is present but unresponsive.

How to eliminate wrong answers

Option A is wrong because if the subnet were public with a route to an Internet Gateway, the traceroute would show a third hop to the Internet Gateway's public IP or beyond, not stop at 10.0.0.1. Option C is wrong because a private subnet with a route to a NAT Gateway would show a third hop to the NAT Gateway's private IP (e.g., 10.0.0.100) before reaching the Internet, not stop at the VPC router. Option D is wrong because a VPN connection would route traffic through a Virtual Private Gateway, which would appear as a hop with a private IP in the VPC's CIDR range (e.g., 10.0.0.2) and then to the on-premises network, not stop at 10.0.0.1.

Practice this question →

MCQmedium

A company is designing a multi-region active-active application using Application Load Balancers (ALBs) behind AWS Global Accelerator. The application uses Aurora MySQL global database. Which design should be used to minimize cross-region latency for writes?

A.Use Route 53 latency-based routing with a single ALB in the primary region.

B.Use Amazon CloudFront with origins in both regions and cache invalidation for writes.

C.Use Global Accelerator with a single ALB endpoint in one region and failover to the second region.

D.Deploy an ALB in each region with a Global Accelerator endpoint group containing both ALBs.

AnswerD

Global Accelerator with two endpoints provides active-active, anycast routing to the nearest region.

Why this answer

Deploying an ALB in each region and adding both to a Global Accelerator endpoint group enables active-active traffic distribution with optimal path routing via the AWS global network. Global Accelerator uses Anycast IPs to direct user traffic to the nearest healthy endpoint, minimizing latency. For writes to an Aurora MySQL global database, the primary region handles all write operations, but Global Accelerator ensures that write requests are routed to the primary region's ALB with the lowest possible latency from the client's location, while read traffic can be served locally from the secondary region's ALB.

Exam trap

The trap here is that candidates often assume Global Accelerator only supports active-passive failover, but it actually supports active-active configurations with multiple endpoints in an endpoint group, which is essential for minimizing cross-region latency in a multi-region setup.

How to eliminate wrong answers

Option A is wrong because Route 53 latency-based routing does not provide static Anycast IPs and can introduce DNS caching delays, making it unsuitable for minimizing cross-region write latency in an active-active design. Option B is wrong because CloudFront is a content delivery network optimized for static and dynamic content caching, not for handling database write operations; cache invalidation does not reduce write latency to an Aurora global database. Option C is wrong because using a single ALB endpoint with failover to a second region creates an active-passive architecture, not active-active, and fails to minimize latency for writes as traffic is not distributed to the nearest region.

Practice this question →

MCQmedium

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises data centers. They want to centralize internet traffic through a single VPC that has an internet gateway. Which Transit Gateway feature should they enable?

A.Transit Gateway route tables

B.VPN attachments

C.Multicast support

D.IPsec acceleration

AnswerA

Route tables allow you to centralize internet traffic through a specific VPC.

Why this answer

To centralize internet traffic through a single VPC with an internet gateway, you need to control the routing of traffic from other VPCs and on-premises networks. Transit Gateway route tables allow you to isolate or share routes between attachments, enabling you to create a default route (0.0.0.0/0) pointing to the centralized VPC's attachment. This ensures all outbound internet traffic from other VPCs is forwarded to the egress VPC, which then uses its internet gateway.

Exam trap

The trap here is that candidates often confuse Transit Gateway route tables with VPC route tables, thinking that simply attaching an internet gateway to a VPC will automatically route traffic from other VPCs through it, without realizing that explicit route table entries in the Transit Gateway are required to direct traffic to the egress VPC.

How to eliminate wrong answers

Option B is wrong because VPN attachments are used to connect on-premises networks over IPsec tunnels, not to centralize internet traffic through a specific VPC. Option C is wrong because multicast support enables group communication using UDP multicast traffic, which is unrelated to routing internet-bound traffic to a single egress point. Option D is wrong because IPsec acceleration is a feature to offload IPsec encryption processing, not a routing or forwarding mechanism for internet traffic centralization.

Practice this question →

MCQeasy

A company is designing a multi-Region application using Amazon Route 53 latency-based routing. The application must be highly available and failover automatically if an AWS Region becomes unavailable. What should the company do to meet these requirements?

A.Configure latency-based routing with health checks and enable DNS failover.

B.Configure active-passive failover with latency-based routing and associate health checks with each record.

C.Configure geolocation routing policies and associate health checks.

D.Configure weighted routing policies with equal weights for all regions.

AnswerB

Correct: Active-passive failover with health checks and latency routing provides automatic regional failover.

Why this answer

It combines latency-based routing with health checks and active-passive failover, which allows Route 53 to route traffic to the region with the lowest latency under normal conditions and automatically fail over to the passive region if the active region's health check fails. This meets the high availability and automatic failover requirements by leveraging Route 53's DNS failover mechanism, which updates DNS responses based on health check status.

Exam trap

The trap here is that candidates often assume that simply enabling health checks with latency-based routing (Option A) is sufficient for automatic failover, but without explicitly configuring an active-passive failover policy, Route 53 does not have a defined secondary target to fail over to when all endpoints in a latency-based set become unhealthy.

How to eliminate wrong answers

Option A is wrong because while it mentions latency-based routing with health checks and DNS failover, it does not specify active-passive failover, which is necessary to ensure a clear failover target when a region becomes unavailable; without an active-passive setup, latency-based routing alone may still send traffic to unhealthy endpoints if all regions are considered active. Option C is wrong because geolocation routing policies route traffic based on the geographic location of the user, not latency or availability, and do not provide automatic failover between regions based on health checks. Option D is wrong because weighted routing policies distribute traffic based on weights and do not inherently support failover; without health checks and active-passive configuration, traffic would continue to be sent to an unavailable region.

Practice this question →

Multi-Selectmedium

A company is designing a network for a VPC with a CIDR of 10.0.0.0/16. The VPC has three private subnets in three different Availability Zones. The company needs to provide internet access to instances in the private subnets for software updates. The architecture must be highly available and cost-effective. Which TWO actions should the network engineer take?

Select 2 answers

A.Configure each private subnet's route table to route 0.0.0.0/0 to the NAT Gateway in the same Availability Zone.

B.Use a NAT instance in an Auto Scaling group.

C.Deploy a NAT Gateway in each Availability Zone.

D.Use a single route table for all private subnets and route to one NAT Gateway.

E.Deploy a single NAT Gateway in one Availability Zone.

AnswersA, C

This ensures traffic uses the NAT Gateway in the same AZ.

Why this answer

Configuring each private subnet's route table to route 0.0.0.0/0 to the NAT Gateway in the same Availability Zone ensures that traffic from instances in that subnet uses a NAT Gateway that is in the same AZ, avoiding cross-AZ data transfer costs and maintaining high availability. Option C is correct because deploying a NAT Gateway in each Availability Zone provides redundancy; if one AZ fails, the other NAT Gateways continue to provide internet access, meeting the high availability requirement while remaining cost-effective compared to using NAT instances with Auto Scaling.

Exam trap

The ANS-C01 exam often tests the misconception that a single NAT Gateway is sufficient for high availability, but the trap here is that a NAT Gateway is an AZ-scoped resource, so you need one per AZ to avoid a single point of failure and cross-AZ data transfer costs.

Practice this question →

MCQhard

A company has multiple VPCs connected via AWS Transit Gateway. They need to inspect all inter-VPC traffic using a centralized firewall appliance. What is the most efficient way to achieve this?

A.Attach the firewall appliance to the Transit Gateway and configure Transit Gateway route tables to send traffic to the appliance

B.Enable VPC Flow Logs and analyze traffic patterns

C.Create VPC Gateway Endpoints for each VPC and route traffic through them

D.Use a Network Load Balancer to distribute traffic to the firewall appliance

AnswerA

This centralizes inspection by routing inter-VPC traffic through the firewall appliance.

Why this answer

Attaching the firewall appliance to the Transit Gateway and configuring Transit Gateway route tables to send traffic to the appliance is the most efficient method because it allows the Transit Gateway to act as a central hub, directing all inter-VPC traffic through the firewall for inspection without requiring complex peering or per-VPC routing changes. This leverages the Transit Gateway's route table capabilities to create a single inspection point, minimizing latency and administrative overhead.

Exam trap

The trap here is that candidates often confuse Transit Gateway route tables with VPC route tables, assuming they can simply point VPC routes to the firewall, but the Transit Gateway's centralized route table is the key to efficiently steering all inter-VPC traffic through a single inspection point without per-VPC configuration.

How to eliminate wrong answers

Option B is wrong because VPC Flow Logs only capture metadata about traffic (e.g., source/destination IPs, ports) for monitoring and analysis, but they cannot inspect or filter traffic; they provide no mechanism to enforce security policies or block malicious traffic. Option C is wrong because VPC Gateway Endpoints (e.g., for S3 or DynamoDB) are used for private connectivity to AWS services, not for routing or inspecting inter-VPC traffic; they do not support traffic inspection or firewall functionality. Option D is wrong because a Network Load Balancer operates at Layer 4 and distributes traffic based on IP/port, but it does not inspect traffic content; using it with a firewall appliance would add unnecessary complexity and latency without providing centralized routing control like the Transit Gateway.

Practice this question →

MCQmedium

A company has multiple VPCs across different AWS Regions and wants to enable communication between them using AWS's global network backbone. Which solution meets these requirements with minimal operational overhead?

A.Use AWS Transit Gateway with inter-Region peering.

B.Set up AWS Direct Connect connections to each VPC.

C.Create VPC peering connections between each pair of VPCs.

D.Use AWS Site-to-Site VPN between VPCs.

AnswerA

Simplifies connectivity across Regions.

Why this answer

AWS Transit Gateway with inter-Region peering is correct because it allows you to connect multiple VPCs across different AWS Regions using AWS's global network backbone, providing a hub-and-spoke architecture that scales easily. This solution minimizes operational overhead by centralizing routing and eliminating the need to manage individual connections between each VPC, as Transit Gateway automatically handles route propagation and traffic distribution across peered transit gateways.

Exam trap

AWS often tests the misconception that VPC peering is the simplest solution for multi-VPC connectivity, but the trap here is that VPC peering lacks transitive routing and requires a full mesh for more than two VPCs, making it operationally heavy for multi-region setups, whereas Transit Gateway with inter-Region peering provides a scalable, centrally managed alternative.

How to eliminate wrong answers

Option B is wrong because AWS Direct Connect is a dedicated physical connection from on-premises to AWS, not designed for inter-VPC or inter-Region VPC communication, and would require additional virtual interfaces and complex routing to connect multiple VPCs across regions, increasing operational overhead. Option C is wrong because VPC peering does not support transitive routing, meaning you would need to create a full mesh of peering connections between every pair of VPCs, which becomes unmanageable as the number of VPCs grows and does not leverage AWS's global backbone for inter-Region traffic efficiently. Option D is wrong because AWS Site-to-Site VPN is typically used for connecting on-premises networks to AWS VPCs over the public internet, not for inter-VPC communication within AWS, and it introduces latency and complexity compared to using Transit Gateway peering over the AWS global network.

Practice this question →

MCQeasy

A solutions architect needs to design a highly available web application that uses an Application Load Balancer (ALB) and spans multiple Availability Zones (AZs) in a single region. The application must be able to handle a sudden increase in traffic without manual intervention. Which feature should the architect enable on the ALB to meet this requirement?

A.Enable connection draining

B.Enable sticky sessions

C.Enable cross-zone load balancing

D.Enable deletion protection

AnswerC

Cross-zone load balancing distributes traffic evenly across instances in all AZs, allowing the ALB to handle spikes by using all healthy instances effectively.

Why this answer

Cross-zone load balancing distributes incoming traffic evenly across all registered targets in all enabled Availability Zones, rather than sending traffic only to targets in the same AZ as the load balancer node. This ensures that if one AZ receives more traffic than another, the ALB can still balance the load across all healthy instances, allowing the application to handle sudden traffic spikes without manual scaling intervention.

Exam trap

The trap here is that candidates often confuse cross-zone load balancing with auto scaling, but cross-zone load balancing is a feature of the ALB itself that distributes existing traffic more evenly, whereas auto scaling handles capacity changes; the question specifically asks for a feature to handle sudden traffic increase without manual intervention, and cross-zone load balancing ensures the ALB can use all available capacity across AZs immediately.

How to eliminate wrong answers

Option A is wrong because connection draining (also known as deregistration delay) is used to complete in-flight requests before an instance is deregistered, not to handle sudden traffic increases. Option B is wrong because sticky sessions (session affinity) bind a user's session to a specific target, which can cause uneven load distribution and does not help with handling traffic spikes. Option D is wrong because deletion protection prevents accidental deletion of the ALB, but has no effect on traffic handling or scalability.

Practice this question →

MCQhard

A company runs a critical application on Amazon EC2 instances in a VPC. The application receives data from an on-premises data center over an AWS Direct Connect connection. The company wants to add redundant connectivity using a VPN connection over the internet. They need to ensure that traffic from on-premises to AWS uses the Direct Connect connection when it is healthy, and only fails over to the VPN if Direct Connect fails. Which configuration achieves this?

A.Advertise a more specific prefix over Direct Connect and a less specific prefix over VPN, and set a higher MED value on the VPN routes.

B.Advertise the same prefix over both connections but prepend AS_PATH multiple times on the Direct Connect routes.

C.Set a higher BGP weight on the VPN routes.

D.Set a lower BGP local preference on the Direct Connect routes.

AnswerA

BGP prefers more specific prefixes. Higher MED on VPN makes Direct Connect routes preferred when both are available.

Why this answer

Advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /20) over VPN, combined with a higher MED value on the VPN routes, ensures that the Direct Connect path is preferred when healthy. BGP selects the most specific prefix first, and if prefixes are identical, lower MED is preferred; here, the more specific prefix over Direct Connect wins, and the higher MED on VPN acts as a tie-breaker for any overlapping less specific routes, guaranteeing failover only when Direct Connect is unavailable.

Exam trap

The ANS-C01 exam often tests the misconception that AS_PATH prepending or local preference adjustments alone can force primary path selection, but the trap here is that candidates overlook the critical role of prefix specificity in BGP path selection, which takes precedence over MED, AS_PATH, and local preference when prefixes differ.

How to eliminate wrong answers

Option B is wrong because prepending AS_PATH multiple times on Direct Connect routes makes that path appear longer (higher AS_PATH length), which would cause BGP to prefer the VPN path instead, defeating the requirement to prefer Direct Connect. Option C is wrong because setting a higher BGP weight on VPN routes makes them more preferred (higher weight is preferred), which would cause traffic to use the VPN over Direct Connect, opposite of the desired behavior. Option D is wrong because setting a lower BGP local preference on Direct Connect routes makes them less preferred (lower local preference is less preferred), which would cause BGP to select the VPN path as primary, again failing the requirement.

Practice this question →

MCQhard

A network engineer is designing a VPC with public and private subnets. The private subnets must have outbound internet access for software updates but must not be directly reachable from the internet. The company wants to minimize cost and operational overhead. Which solution meets these requirements?

A.Deploy a NAT Gateway in a public subnet and add a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway.

B.Use an egress-only internet gateway and route 0.0.0.0/0 to it from the private subnets.

C.Create a VPC peering connection to a VPC with internet access and route 0.0.0.0/0 through the peering connection.

D.Attach an internet gateway to the VPC and add a route in the private subnet route table pointing 0.0.0.0/0 to the internet gateway.

AnswerA

NAT Gateway allows outbound traffic from private subnets while blocking unsolicited inbound traffic.

Why this answer

A NAT Gateway, deployed in a public subnet with an associated Elastic IP, enables instances in private subnets to initiate outbound IPv4 connections to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. Adding a default route (0.0.0.0/0) in the private subnet route table pointing to the NAT Gateway satisfies the requirement for outbound-only internet access with minimal cost and operational overhead, as NAT Gateway is a managed service that scales automatically.

Exam trap

AWS often tests the misconception that an egress-only internet gateway can be used for IPv4 outbound traffic, or that VPC peering can be used to route internet-bound traffic through another VPC, when in fact both are invalid for this scenario.

How to eliminate wrong answers

Option B is wrong because an egress-only internet gateway is designed for IPv6 traffic only; it cannot provide outbound internet access for IPv4 traffic, which is required for software updates. Option C is wrong because VPC peering does not support transitive routing; routing 0.0.0.0/0 through a peering connection to another VPC would not provide internet access unless that VPC has its own internet gateway and proper routing, and it violates AWS peering rules (cannot route to internet via peering). Option D is wrong because adding a route to an internet gateway in a private subnet route table would make instances directly reachable from the internet (if they have public IPs) or would not work at all for instances without public IPs; an internet gateway requires a public IP on the instance for outbound traffic, and it does not provide the required inbound restriction.

Practice this question →

MCQhard

A company is designing a multi-account AWS environment using AWS Organizations. The company wants to centralize outbound internet traffic from all VPCs in all accounts through a single VPC in a shared services account. The shared services account has a VPC with a NAT gateway and an internet gateway. Which architecture meets this requirement?

A.Create VPC gateway endpoints for all AWS services in each VPC.

B.Set up a VPN connection from each VPC to the shared services VPC and use the latter's internet gateway.

C.Attach all VPCs to a transit gateway and route traffic through a shared services VPC that has NAT gateway and internet gateway.

D.Peer each VPC to the shared services VPC and configure a default route pointing to the shared services VPC's NAT gateway.

AnswerC

Transit gateway enables transitive routing and centralized internet.

Why this answer

A transit gateway allows you to centrally route traffic from multiple VPCs across different AWS accounts to a shared services VPC. By attaching all VPCs to a transit gateway and configuring route tables appropriately, you can force all outbound internet traffic from the spoke VPCs to go through the shared services VPC's NAT gateway and internet gateway, centralizing egress traffic.

Exam trap

The trap here is that candidates often assume VPC peering can be used as a hub-and-spoke solution for internet egress, but they forget that VPC peering does not support transitive routing and that NAT gateways are not reachable across a peering connection, making Option D invalid.

How to eliminate wrong answers

Option A is wrong because VPC gateway endpoints only provide private connectivity to specific AWS services (e.g., S3, DynamoDB) and do not route general outbound internet traffic; they cannot replace a NAT gateway or internet gateway. Option B is wrong because setting up a VPN connection from each VPC to the shared services VPC introduces unnecessary complexity, latency, and bandwidth limitations compared to using a transit gateway, and VPNs are typically used for hybrid connectivity, not for routing internet-bound traffic between VPCs within the same AWS environment. Option D is wrong because VPC peering does not support transitive routing; a default route in a peered VPC pointing to the shared services VPC's NAT gateway would not work because the NAT gateway's IP address is not reachable across a peering connection (NAT gateways are not transitive), and peering also does not allow a single shared services VPC to act as a hub for many VPCs without complex full-mesh peering.

Practice this question →

MCQeasy

A company is deploying an internet-facing application in AWS. The application must only accept traffic from specific IP addresses of business partners. Which AWS service should be used to enforce this restriction?

A.Network ACLs with inbound allow rules

B.Security Groups with inbound allow rules

C.Amazon Route 53 geoproximity routing

D.AWS WAF with an IP set rule

AnswerD

AWS WAF can filter traffic based on IP addresses using IP sets.

Why this answer

AWS WAF with an IP set rule is the correct choice because it operates at the application layer (Layer 7) and can inspect HTTP/HTTPS requests to allow or block traffic based on source IP addresses. This service is specifically designed to filter web traffic to internet-facing applications, making it ideal for enforcing IP-based restrictions from business partners. Network ACLs and Security Groups operate at the network and instance levels, respectively, and cannot provide the granular, application-layer control required for this use case.

Exam trap

The ANS-C01 exam often tests the misconception that Security Groups or Network ACLs are sufficient for application-layer IP filtering, but they operate at lower network layers and cannot inspect HTTP traffic or be applied to services like CloudFront or ALB for IP-based allow lists.

How to eliminate wrong answers

Option A is wrong because Network ACLs are stateless and operate at the subnet level (Layer 3/4), not at the application layer, and they cannot inspect HTTP/HTTPS traffic or provide the granular IP-based filtering needed for an internet-facing application. Option B is wrong because Security Groups are stateful and operate at the instance level (Layer 3/4), but they are designed for EC2 instance traffic control and cannot be applied directly to an internet-facing application like an Application Load Balancer or CloudFront distribution for IP-based allow lists. Option C is wrong because Amazon Route 53 geoproximity routing is a DNS-based traffic routing policy that directs users based on geographic location, not a security mechanism to enforce IP allow lists; it does not block traffic at the application layer.

Practice this question →

MCQhard

A company is designing a network for a real-time gaming application that requires the lowest possible latency across AWS Regions. The application uses UDP traffic. Which AWS service should be used to optimize traffic routing?

A.AWS Direct Connect with multiple connections.

B.AWS Global Accelerator.

C.Amazon Route 53 with latency-based routing.

D.Amazon CloudFront with custom origins.

AnswerB

Global Accelerator supports UDP and uses the AWS backbone to reduce latency.

Why this answer

AWS Global Accelerator uses the Anycast IP address concept to route UDP traffic over the AWS global network, minimizing latency by directing traffic to the nearest healthy endpoint. It is specifically designed for real-time applications like gaming that require low latency and jitter, and it supports UDP traffic natively.

Exam trap

AWS often tests the misconception that DNS-based routing (like Route 53 latency routing) provides the same latency optimization as Global Accelerator, but the trap is that DNS routing only affects the initial resolution and does not control the actual network path for ongoing UDP traffic, while Global Accelerator optimizes every packet in real time.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect provides dedicated private connectivity but does not optimize traffic routing across regions for latency; it is a physical connection to a single region and does not use Anycast or global path optimization. Option C is wrong because Amazon Route 53 with latency-based routing operates at the DNS level, which introduces DNS caching and resolution delays, and it does not optimize the actual network path for UDP traffic after the initial DNS lookup. Option D is wrong because Amazon CloudFront is a content delivery network optimized for HTTP/HTTPS traffic and does not support UDP traffic; it is designed for web content acceleration, not real-time gaming UDP streams.

Practice this question →

MCQhard

A company has a VPC with public and private subnets. The public subnet has a NAT gateway for outbound internet access from private subnets. The private subnets have EC2 instances that need to access an S3 bucket in the same region. The company wants to minimize data transfer costs and avoid traversing the internet. What is the MOST cost-effective solution?

A.Configure an S3 bucket policy that restricts access to the VPC's public IP addresses.

B.Create a VPC Gateway Endpoint for S3 and attach a policy allowing access from the private subnets.

C.Route traffic to the NAT gateway and then to the S3 bucket using a VPC peering connection.

D.Create a VPC Interface Endpoint for S3 and associate with the private subnets.

AnswerB

Gateway endpoints are free and keep traffic within AWS network.

Why this answer

A VPC Gateway Endpoint for S3 allows private subnet instances to access S3 over the AWS network without traversing the internet or a NAT gateway, eliminating data transfer costs for the NAT gateway and avoiding internet egress charges. This is the most cost-effective solution because gateway endpoints are free and use prefix lists in the route table to direct traffic to S3 via the AWS backbone.

Exam trap

AWS often tests the misconception that interface endpoints are always the best choice for AWS service access, but for S3 and DynamoDB, gateway endpoints are the most cost-effective because they are free and avoid the per-GB data processing charges of interface endpoints.

How to eliminate wrong answers

Option A is wrong because restricting access to the VPC's public IP addresses does not address routing; private instances still need a path to S3, and this policy alone does not prevent traffic from going through the NAT gateway or internet. Option C is wrong because routing traffic to the NAT gateway and then to S3 via a VPC peering connection is unnecessary, incurs NAT gateway data processing and hourly charges, and VPC peering is not used for S3 access—S3 is a service endpoint, not a peered VPC. Option D is wrong because a VPC Interface Endpoint for S3 incurs hourly charges and per-GB data processing costs, making it more expensive than a gateway endpoint, which is free and designed for S3 and DynamoDB access within the same region.

Practice this question →

MCQhard

A company has a VPC with a CIDR block of 10.0.0.0/16. It has two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). Both subnets have a route to an Internet Gateway. An EC2 instance in subnet A has a security group that allows inbound HTTP from 0.0.0.0/0. The instance's network ACL allows inbound HTTP from 0.0.0.0/0. Users report they cannot access the web server. What is the most likely cause?

A.The instance does not have a public IP address

B.The network ACL inbound rule is incorrectly configured

C.The security group is not associated with the instance

D.The route table does not have a route to the Internet Gateway

AnswerA

Without a public IP, the instance is not reachable from the internet.

Why this answer

The most likely cause is that the EC2 instance does not have a public IP address. Even though the security group and network ACL allow inbound HTTP from 0.0.0.0/0, and the subnet has a route to an Internet Gateway (IGW), the instance must have a public IPv4 address (or an Elastic IP) for the IGW to translate its private IP to a public IP and route traffic from the internet. Without a public IP, the IGW cannot forward inbound traffic to the instance, making it unreachable from the internet.

Exam trap

The trap here is that candidates often assume that allowing traffic in both the security group and network ACL is sufficient, overlooking the fundamental requirement of a public IP address for internet-facing communication via an Internet Gateway.

How to eliminate wrong answers

Option B is wrong because the network ACL inbound rule is explicitly stated as allowing HTTP from 0.0.0.0/0, so it is correctly configured and not the cause. Option C is wrong because the security group is described as allowing inbound HTTP from 0.0.0.0/0, and if it were not associated with the instance, the instance would have no security group rules (default deny), but the question implies it is associated; the issue is not association but the lack of a public IP. Option D is wrong because the question states both subnets have a route to an Internet Gateway, so the route table is correctly configured.

Practice this question →

MCQmedium

Based on the route table, which of the following is true?

A.The route table is the main route table for the VPC

B.The subnet is connected to a Transit Gateway

C.The subnet has a VPN connection to a network with CIDR 172.31.0.0/16

D.The subnet is a private subnet with no internet access

AnswerC

The route to vgw for 172.31.0.0/16 indicates a VPN connection.

Why this answer

The route table includes a route for destination 172.31.0.0/16 pointing to a virtual private gateway (vgw-xxxx), which is used for a VPN connection. This indicates that the subnet associated with this route table has a VPN connection to a network with CIDR 172.31.0.0/16, as the route directs traffic for that CIDR to the VPN gateway.

Exam trap

The trap here is that candidates often confuse a virtual private gateway (used for VPN/Direct Connect) with a Transit Gateway, or assume that any route to a non-local CIDR implies a Transit Gateway, when in fact the route target (vgw vs. tgw) is the key differentiator.

How to eliminate wrong answers

Option A is wrong because the main route table for a VPC cannot have a route pointing to a virtual private gateway unless explicitly added, but more importantly, the route table shown is not identified as the main route table (it lacks the 'Main' designation in the console). Option B is wrong because the route table does not contain any route pointing to a transit gateway (tgw-xxxx); the only gateway target is a virtual private gateway (vgw-xxxx), which is used for VPN or Direct Connect, not Transit Gateway. Option D is wrong because the route table includes a local route for the VPC CIDR and a route to an internet gateway (igw-xxxx) for 0.0.0.0/0, which means the subnet is a public subnet with internet access, not a private subnet.

Practice this question →

Multi-Selectmedium

Which TWO options are valid methods to connect multiple VPCs together in a hub-and-spoke topology? (Select TWO.)

Select 2 answers

A.VPC peering

B.AWS Direct Connect

C.VPC Endpoints

D.AWS Site-to-Site VPN

E.AWS Transit Gateway

AnswersA, E

Can be used to create hub-and-spoke.

Why this answer

VPC peering (A) is a valid method because it establishes a direct, one-to-one network connection between two VPCs using the AWS global backbone, enabling private IPv4 or IPv6 communication without gateways or VPNs. AWS Transit Gateway (E) is valid because it acts as a central hub that connects multiple VPCs and on-premises networks through a single, scalable gateway, simplifying the hub-and-spoke topology management.

Exam trap

AWS often tests the misconception that AWS Direct Connect or Site-to-Site VPN can directly interconnect multiple VPCs, but these are designed for on-premises connectivity, not VPC-to-VPC peering or transit routing.

Practice this question →

MCQeasy

A company wants to design a highly available architecture for a web application that runs on EC2 instances in an Auto Scaling group across multiple Availability Zones. The application must be able to handle sudden traffic spikes. Which load balancing solution provides the best combination of high availability, automatic scaling, and SSL offloading?

A.Amazon CloudFront with an origin pointing to the Auto Scaling group

B.Network Load Balancer

C.Application Load Balancer

D.Classic Load Balancer

AnswerC

ALB provides SSL termination, health checks, and integrates with Auto Scaling.

Why this answer

The Application Load Balancer (ALB) is the correct choice because it operates at Layer 7, supports content-based routing, integrates natively with Auto Scaling groups for automatic scaling, and provides SSL offloading (TLS termination) at the load balancer. This combination ensures high availability across multiple Availability Zones while handling sudden traffic spikes through elastic scaling of both the ALB and the backend EC2 instances.

Exam trap

The ANS-C01 exam often tests the misconception that a Network Load Balancer (NLB) is always the best for high availability and scaling, but candidates forget that SSL offloading is a Layer 7 function that only the Application Load Balancer (or Classic Load Balancer with limited support) can perform natively.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations; it does not perform load balancing or SSL offloading for dynamic traffic spikes, and its origin pointing to an Auto Scaling group does not provide the same level of automatic scaling and health-check-driven traffic distribution as a regional load balancer. Option B is wrong because a Network Load Balancer (NLB) operates at Layer 4 and does not support SSL offloading (TLS termination) natively; it forwards encrypted traffic to targets, requiring the backend instances to handle decryption, which contradicts the requirement for SSL offloading. Option D is wrong because the Classic Load Balancer (CLB) is a legacy option that lacks advanced features like path-based routing, native HTTP/2 support, and the same level of integration with Auto Scaling groups; it also has limited scalability and is not recommended for modern architectures.

Practice this question →

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16. They need to connect to two on-premises data centers, each with overlapping CIDR blocks (192.168.0.0/16). The company wants to use AWS Site-to-Site VPN with dynamic routing (BGP). Which design allows the VPC to reach both data centers without route conflicts?

A.Create two VPN connections to a single virtual private gateway and advertise the same CIDR from both data centers. Use BGP AS_PATH prepending to influence routing.

B.Create a single VPN connection with two tunnels to the same virtual private gateway. Use different BGP ASNs for each data center.

C.Create two separate virtual private gateways, each in a different VPC, and use VPC peering. Alternatively, use a transit gateway with separate VPN attachments and BGP communities to tag routes.

D.Create two VPN connections to the same virtual private gateway. Use static routes with different metric values.

AnswerC

Transit gateway with separate attachments and BGP communities can handle overlapping CIDRs by using route priority or filtering.

Why this answer

Overlapping CIDR blocks cannot be advertised to the same virtual private gateway (VPG) without causing route conflicts. By using a transit gateway with separate VPN attachments, each data center's routes are isolated in separate route tables, and BGP communities can be used to tag and differentiate routes. This design allows the VPC to reach both data centers by leveraging the transit gateway's ability to manage overlapping prefixes through separate route tables and path selection.

Exam trap

AWS often tests the misconception that a single virtual private gateway can handle overlapping CIDRs by using BGP attributes like AS_PATH prepending, but the fundamental limitation is that the VPG's route table cannot store duplicate prefixes, regardless of BGP attributes.

How to eliminate wrong answers

Option A is wrong because advertising the same CIDR from both data centers to a single VPG will cause the VPG to see duplicate routes, and AS_PATH prepending only influences route preference, not route uniqueness; the VPG cannot distinguish between the two overlapping prefixes, leading to routing conflicts. Option B is wrong because a single VPN connection with two tunnels still terminates on one VPG, and using different BGP ASNs does not resolve the issue of overlapping CIDRs; the VPG will still receive identical prefixes from both tunnels and cannot differentiate them. Option D is wrong because static routes with different metric values cannot be used with dynamic routing (BGP) as specified in the question; moreover, static routes to the same VPG for overlapping CIDRs would create ambiguity and the VPG would not know which tunnel to use for a given destination.

Practice this question →

MCQhard

A large financial services company is migrating its on-premises data center to AWS. The network design must meet strict low-latency requirements for trading applications that communicate with external exchanges. The company has two AWS Direct Connect connections from two different providers to two different AWS Direct Connect locations in the same region. They have a VPC with multiple subnets across three Availability Zones. The trading applications are deployed on EC2 instances in private subnets and need to communicate with external exchanges over the Direct Connect connections. The company also requires high availability and automatic failover if one Direct Connect connection fails. The network team has configured two virtual interfaces (VIFs) for private connectivity to the VPC, one on each Direct Connect connection, and has set up BGP sessions. However, during a failover test, traffic does not fail over as expected. The team notices that the VPC route tables have static routes pointing to the virtual private gateway (VGW) with the same prefix, but no BGP routes are propagated. What is the most likely cause of the failover issue, and what should be done to resolve it?

A.The VPC route tables do not have route propagation enabled for the VGW. Enable route propagation in the route tables.

B.The BGP timers are set too high, causing slow convergence. Reduce the BGP keepalive and hold timers.

C.The VPC route tables have static routes that are overriding the BGP routes. Remove the static routes and rely on BGP routes propagated through the VGW.

D.The BGP configuration on the on-premises router is using AS_PATH prepending, making the backup path less preferred. Remove AS_PATH prepending.

AnswerC

Static routes have higher priority than BGP routes, preventing failover.

Why this answer

The failover issue occurs because static routes in the VPC route tables take precedence over BGP-propagated routes, even when the BGP session goes down. Since the static routes point to the virtual private gateway (VGW) with the same prefix, traffic continues to use the failed Direct Connect connection instead of failing over to the active one. Removing the static routes and enabling route propagation allows BGP to dynamically update the route tables based on the availability of the Direct Connect connections.

Exam trap

AWS often tests the misconception that enabling route propagation alone ensures failover, but the trap here is that static routes in the VPC route table take precedence over BGP-propagated routes, so they must be removed for automatic failover to work.

How to eliminate wrong answers

Option A is wrong because route propagation is already implied to be disabled or not the primary issue; the problem is that static routes override BGP routes, not that propagation is missing. Option B is wrong because BGP timers affect convergence speed but do not prevent failover entirely; the core issue is route precedence, not timer values. Option D is wrong because AS_PATH prepending influences path selection on the on-premises side, not within the VPC route tables; the failover failure is due to static routes in the VPC, not BGP path preference.

Practice this question →

MCQmedium

A company is designing a multi-region active-active architecture using Application Load Balancers (ALBs) and AWS Global Accelerator. The application servers are in private subnets behind Network Load Balancers (NLBs). The company needs to ensure that traffic from a client is consistently routed to the same ALB endpoint for the duration of a session. Which configuration should be used?

A.Configure cross-zone load balancing on the NLBs and enable stickiness on the target groups.

B.Enable proxy protocol on the NLB target groups and configure stickiness on the NLB.

C.Enable stickiness on the ALB target groups with a duration of 1 second.

D.Enable client IP address preservation on the Global Accelerator endpoint groups and configure stickiness on the ALB based on the client IP.

AnswerD

This ensures sessions are consistently routed to the same ALB based on the client's IP.

Why this answer

Global Accelerator preserves the client IP address when client IP address preservation is enabled on the endpoint group, allowing the ALB to see the original client IP. Configuring stickiness on the ALB based on the client IP ensures that all requests from the same client IP are routed to the same ALB endpoint for the duration of the session, which is essential for session persistence in an active-active multi-region architecture.

Exam trap

The trap here is that candidates often assume stickiness must be configured on the NLB or that proxy protocol is required, but they overlook that Global Accelerator can preserve the client IP, which is the key to enabling ALB-based stickiness using the client IP as the persistence key.

How to eliminate wrong answers

Option A is wrong because cross-zone load balancing and stickiness on the NLB target groups would only ensure persistence at the NLB level, not at the ALB level, and the NLB is not the endpoint that needs session affinity—the ALB is. Option B is wrong because enabling proxy protocol on the NLB target groups passes the client IP in a header, but stickiness on the NLB does not guarantee that the ALB will consistently route traffic to the same ALB endpoint; the ALB must handle stickiness itself. Option C is wrong because setting stickiness duration to 1 second is effectively disabling stickiness, as sessions would not persist long enough to maintain affinity for a meaningful session duration.

Practice this question →

100

MCQeasy

A company is migrating an on-premises application to AWS. The application requires low-latency, high-throughput connectivity between the on-premises data center and the AWS VPC. The company wants a dedicated, private connection that bypasses the internet. Which AWS service should they use?

A.AWS Direct Connect

B.AWS Transit Gateway

C.AWS Site-to-Site VPN

D.VPC Peering

AnswerA

Dedicated, private, high-bandwidth connection.

Why this answer

AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the internet entirely. This ensures low-latency, high-throughput connectivity ideal for latency-sensitive or high-volume workloads, as it uses a physical cross-connect or hosted virtual interface over a private circuit.

Exam trap

The trap here is that candidates often confuse AWS Transit Gateway as a connectivity method itself, when it is actually a hub that requires an underlying connection (Direct Connect or VPN) to reach on-premises networks.

How to eliminate wrong answers

Option B (AWS Transit Gateway) is wrong because it is a network transit hub that interconnects VPCs and on-premises networks via VPN or Direct Connect, but it does not itself provide a dedicated private connection; it requires an underlying connectivity method like Direct Connect or VPN. Option C (AWS Site-to-Site VPN) is wrong because it uses the public internet, encrypted over IPsec tunnels, which introduces latency and throughput variability, failing the requirement to bypass the internet. Option D (VPC Peering) is wrong because it connects two VPCs within AWS using private IP addresses, not an on-premises data center, and cannot extend to external networks.

Practice this question →

101

MCQhard

A company is designing a hybrid network with AWS Direct Connect. They have multiple VPCs in the same Region and want to use a single Direct Connect connection to access all VPCs. Which AWS resource should be used?

A.AWS Transit Gateway

B.AWS Site-to-Site VPN

C.Direct Connect Gateway

D.Virtual Private Gateway

AnswerC

Enables multi-VPC access.

Why this answer

A Direct Connect Gateway allows you to associate up to 10 Virtual Private Gateways (VGWs) or Transit Gateways in the same or different AWS accounts, enabling a single Direct Connect connection to reach multiple VPCs in the same Region. This is the correct resource because it acts as a hub that terminates the Direct Connect virtual interfaces (VIFs) and propagates routes to the associated VPCs via their VGWs or Transit Gateways.

Exam trap

The trap here is that candidates often confuse the Direct Connect Gateway with the Transit Gateway, thinking the Transit Gateway alone can terminate the Direct Connect connection, but the Transit Gateway requires a Direct Connect Gateway (via a transit VIF) to be attached to the Direct Connect link.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway is a regional network transit hub that can interconnect VPCs and on-premises networks, but it does not directly terminate a Direct Connect connection; you still need a Direct Connect Gateway to attach the Transit Gateway to the Direct Connect link. Option B is wrong because AWS Site-to-Site VPN is an IPsec-based connection over the internet, not a dedicated private connection, and it cannot replace the Direct Connect Gateway for aggregating multiple VPCs over a single Direct Connect link. Option D is wrong because a Virtual Private Gateway is a per-VPC attachment point for VPN or Direct Connect, but it cannot be shared across multiple VPCs; using a single VGW would only provide access to one VPC, not all VPCs.

Practice this question →

102

MCQeasy

A company wants to ensure that all traffic to and from its VPC is inspected by a security appliance. The appliance must be able to inspect traffic between subnets within the VPC. Which architecture should the company use?

A.Use a Gateway Load Balancer with security appliances in a separate inspection VPC and configure route tables to send traffic to the GWLB endpoint.

B.Deploy a NAT Gateway and route all internet traffic through it.

C.Create a VPC Peering connection to a centralized VPC with security appliances.

D.Attach an Internet Gateway and use Security Groups to log traffic.

AnswerA

GWLB provides transparent inspection of all traffic.

Why this answer

A Gateway Load Balancer (GWLB) with security appliances in a separate inspection VPC allows you to centrally inspect all traffic, including east-west traffic between subnets within the same VPC. By configuring route tables to send traffic to the GWLB endpoint, you can enforce stateful inspection for all inbound, outbound, and inter-subnet traffic without introducing a single point of failure or complex routing.

Exam trap

AWS often tests the misconception that a NAT Gateway or Internet Gateway can provide full traffic inspection, but they only handle specific traffic types and lack the ability to inspect east-west traffic within a VPC.

How to eliminate wrong answers

Option B is wrong because a NAT Gateway only handles outbound internet traffic from private subnets and cannot inspect inbound traffic or traffic between subnets within the VPC. Option C is wrong because a VPC Peering connection does not inherently route traffic through a central inspection point; it simply connects two VPCs, and you would still need additional routing and appliances to force traffic through the security stack. Option D is wrong because an Internet Gateway provides internet access but does not inspect traffic, and Security Groups are stateful firewalls that operate at the instance level, not as inline inspection appliances for all traffic flows.

Practice this question →

103

MCQeasy

A company wants to connect multiple VPCs across different AWS accounts to a common on-premises network using AWS Transit Gateway. Which resource should be used to allow cross-account VPC attachments?

A.AWS PrivateLink

B.VPC peering connection

C.AWS Organizations

D.AWS Resource Access Manager (RAM)

AnswerD

RAM enables sharing Transit Gateways with other accounts.

Why this answer

AWS Resource Access Manager (RAM) enables you to share a Transit Gateway with other AWS accounts within your organization or externally. Once shared, the recipient account can attach its VPCs to the shared Transit Gateway, allowing cross-account VPC attachments to a common on-premises network.

Exam trap

The trap here is that candidates often confuse AWS Organizations with the actual resource sharing mechanism, forgetting that Organizations alone does not share resources—RAM is required to perform the cross-account sharing of Transit Gateways.

How to eliminate wrong answers

Option A is wrong because AWS PrivateLink is used to expose services privately across VPCs via interface VPC endpoints, not for sharing Transit Gateway attachments. Option B is wrong because VPC peering connections only connect two VPCs directly and do not support transitive routing through a Transit Gateway or cross-account attachment sharing. Option C is wrong because AWS Organizations provides centralized management of accounts and policies but does not itself enable resource sharing; it must be used with RAM to share Transit Gateways.

Practice this question →

104

Multi-Selecteasy

A solutions architect is designing a VPC with public and private subnets. The application in the private subnet needs to download patches from the internet. Which TWO options allow outbound internet access while keeping the EC2 instance in the private subnet without a public IP address?

Select 2 answers

A.Attach an Internet Gateway to the VPC and assign a public IP to the instance.

B.Set up a Direct Connect connection to an on-premises data center.

C.Create a VPC endpoint for Amazon S3 and update the route table.

D.Establish a VPN connection to a third-party proxy service.

E.Deploy a NAT Gateway in a public subnet and update the private subnet route table to point 0.0.0.0/0 to the NAT Gateway.

AnswersC, E

VPC endpoint allows private access to S3 without internet.

Why this answer

A VPC endpoint for Amazon S3 allows private subnet instances to access S3 buckets (where patches can be stored) without traversing the internet, using the AWS network backbone. This keeps the EC2 instance private (no public IP) while enabling outbound access to a specific AWS service. Option E is correct because a NAT Gateway in a public subnet provides source network address translation (SNAT) for private instances, translating their private IPs to the NAT Gateway's Elastic IP for outbound internet traffic, while the private instance itself remains without a public IP.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT Gateway requires a public IP on the private instance, but in reality, the NAT Gateway itself has the public IP and performs SNAT, so the private instance never needs a public IP.

Practice this question →

105

MCQeasy

A company needs to allow a specific IP address range (203.0.113.0/24) to access an Amazon RDS database in a private subnet. The RDS instance is deployed in a VPC with no public access. Which configuration step is required?

A.Add a security group rule allowing inbound traffic from 203.0.113.0/24

B.Create an AWS Site-to-Site VPN connection and update route tables to route the on-premises CIDR to the virtual private gateway

C.Assign a public IP address to the RDS instance

D.Modify the network ACL of the private subnet to allow inbound traffic from 203.0.113.0/24

AnswerB

A VPN provides a secure tunnel from on-premises to the VPC, and route tables direct traffic to the VPN gateway.

Why this answer

The RDS instance is in a private subnet with no public access, so it cannot be reached directly from the internet. To allow an on-premises IP range (203.0.113.0/24) to access it, you need a private connection such as an AWS Site-to-Site VPN. This creates an encrypted tunnel over the internet, and the route tables must be updated to direct traffic for the on-premises CIDR to the virtual private gateway (VGW), enabling private IP communication.

Exam trap

The trap here is that candidates often focus on firewall rules (security groups or NACLs) without realizing that a private subnet has no direct internet path, so a VPN or Direct Connect is required first to establish Layer 3 connectivity.

How to eliminate wrong answers

Option A is wrong because security group rules control traffic at the instance level, but the RDS instance in a private subnet has no public endpoint; inbound traffic from the internet cannot reach it without a VPN or Direct Connect. Option C is wrong because assigning a public IP address to an RDS instance is not supported; RDS instances in a VPC are accessed via DNS names that resolve to private IPs, and public access would require a publicly accessible RDS instance, which still uses a security group but is not the correct solution for a private subnet. Option D is wrong because network ACLs are stateless and operate at the subnet level, but they cannot enable internet access to a private subnet; the fundamental issue is the lack of a private network path, not just firewall rules.

Practice this question →

106

Multi-Selecthard

A company is designing a multi-account AWS environment using AWS Transit Gateway. They have 10 VPCs in separate accounts that need to communicate with each other and with an on-premises network via Direct Connect. Which three components are required to enable this connectivity? (Choose three.)

Select 3 answers

A.AWS Resource Access Manager to share the Transit Gateway with other accounts

B.Direct Connect Gateway attached to the Transit Gateway

C.AWS Transit Gateway in the network account

D.VPC Peering connections between each pair of VPCs

E.AWS Site-to-Site VPN connection from the Transit Gateway to the on-premises network

AnswersA, B, C

RAM allows sharing the Transit Gateway with VPCs in other accounts.

Why this answer

Options A, B, and C are correct. AWS Transit Gateway (C) in a central network account acts as a hub for inter-VPC and on-premises connectivity. AWS Resource Access Manager (A) is required to share the Transit Gateway with other accounts so that VPCs in those accounts can attach to it.

A Direct Connect Gateway (B) attached to the Transit Gateway provides connectivity to the on-premises network via Direct Connect. Option D is incorrect because VPC Peering is unnecessary when using Transit Gateway. Option E is incorrect because a Site-to-Site VPN is not required when Direct Connect is already used for on-premises connectivity.

Practice this question →

107

MCQhard

A company has deployed a multi-tier application across three VPCs (VPC-A, VPC-B, VPC-C) in the us-east-1 region. Each VPC has its own CIDR block (10.0.0.0/16, 10.1.0.0/16, 10.2.0.0/16 respectively). All VPCs are attached to an AWS Transit Gateway. The web tier is in VPC-A, the application tier is in VPC-B, and the database tier is in VPC-C. The application servers in VPC-B need to connect to the database servers in VPC-C on TCP port 3306. The database servers are in a private subnet with a security group (sg-db) that allows inbound traffic from the application server security group (sg-app). The application servers have a security group (sg-app) that allows outbound traffic to the database servers. However, the application servers cannot connect to the database servers. The route tables in VPC-B and VPC-C have routes pointing to the Transit Gateway for the other VPC CIDRs. The Transit Gateway has attachments in all three VPCs and has a default route table with propagation enabled. What is the MOST likely cause of the connectivity failure?

A.The Transit Gateway attachments are not associated with the same route table

B.The network ACLs in VPC-B or VPC-C are blocking the traffic

C.The Transit Gateway does not support transitive routing between VPCs

D.The security group sg-app does not allow outbound traffic to the database server's security group

AnswerA

Correct; without association, routes are not propagated to the attachments.

Why this answer

The most likely cause is that the Transit Gateway attachments are not associated with the same route table. In AWS Transit Gateway, for traffic to flow between VPCs, the attachments must be associated with a route table that contains routes for the destination VPC CIDRs. Even though propagation is enabled on the default route table, if the attachments are associated with different route tables (or the default route table is not shared), transitive routing will fail.

Without a common route table association, the Transit Gateway cannot forward traffic between VPC-B and VPC-C.

Exam trap

The trap here is that candidates assume enabling propagation on the default route table automatically allows all inter-VPC traffic, but they overlook the requirement that all attachments must be associated with the same route table for transitive routing to work.

How to eliminate wrong answers

Option B is wrong because network ACLs are stateless and, by default, allow all inbound and outbound traffic; unless explicitly modified, they would not block TCP port 3306 traffic. Option C is wrong because AWS Transit Gateway natively supports transitive routing between all attached VPCs when route tables are properly configured; this is a core feature of the service. Option D is wrong because the security group sg-app allows outbound traffic to the database servers, as stated in the question; the issue is not with outbound rules but with the Transit Gateway routing configuration.

Practice this question →

108

MCQmedium

A network engineer has configured an AWS Site-to-Site VPN connection between a VPC and an on-premises network. The engineer checks the VPN status and sees the output above. What is the MOST likely cause of Tunnel2 being down?

A.The BGP ASN on the on-premises device is misconfigured.

B.The route tables in the VPC do not have a route to the on-premises network.

C.The IKE pre-shared key used for Tunnel2 is incorrect.

D.The IPsec encryption or integrity algorithms do not match between the AWS VPN endpoint and the on-premises device.

AnswerD

Mismatched IPsec parameters cause Phase 2 negotiation failure.

Why this answer

Tunnel2 is down while Tunnel1 is up, indicating a per-tunnel configuration mismatch. The most common cause is a mismatch in IPsec security parameters (encryption, integrity, or DH group) between the AWS VPN endpoint and the on-premises device for that specific tunnel. AWS uses separate pre-shared keys and IPsec settings per tunnel, so a mismatch in algorithms would affect only the misconfigured tunnel.

Exam trap

AWS often tests the distinction between IKE phase 1 (pre-shared key, authentication) and IPsec phase 2 (encryption/integrity algorithms); candidates mistakenly attribute a single tunnel failure to a pre-shared key mismatch, but AWS assigns unique keys per tunnel, so a key error would affect only that tunnel—making algorithm mismatch the more subtle and likely cause when only one tunnel is down.

How to eliminate wrong answers

Option A is wrong because a misconfigured BGP ASN would affect BGP session establishment, but the tunnel itself (IPsec phase 1 and 2) would still come up; the tunnel status shows IPsec layer status, not BGP peering. Option B is wrong because VPC route tables do not affect the tunnel's IPsec negotiation; they only control traffic forwarding once the tunnel is established. Option C is wrong because an incorrect IKE pre-shared key would prevent both IKE phase 1 authentication and the tunnel from coming up, but the question states Tunnel1 is up, and each tunnel uses a unique pre-shared key; if Tunnel2's key were wrong, it would fail, but the more precise cause given the output is an algorithm mismatch, as AWS generates unique keys per tunnel and the key mismatch would be equally likely to affect either tunnel.

Practice this question →

109

Multi-Selecthard

A company has a Direct Connect connection with a private VIF to a VPC. They want to add redundant connectivity using a second Direct Connect connection from a different provider. They need to ensure that if the primary connection fails, traffic automatically fails over to the secondary. Which THREE components are required?

Select 3 answers

A.An AWS Site-to-Site VPN as a backup

B.A second private VIF on the same Direct Connect connection

C.A second Direct Connect connection from a different provider

D.A Direct Connect Gateway

E.BGP sessions on both connections advertising the same prefixes

AnswersC, D, E

Diverse provider ensures no single point of failure.

Why this answer

The requirement specifies redundant connectivity using a second Direct Connect connection from a different provider. This ensures diverse physical paths and provider independence, which is essential for true high availability. A single provider or connection cannot provide the required fault isolation.

Exam trap

The trap here is that candidates often think a second VIF on the same connection provides redundancy, but it does not protect against physical link failure; true redundancy requires separate connections from different providers, a Direct Connect Gateway, and identical BGP prefix advertisements.

Practice this question →

110

MCQeasy

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add IPv6 connectivity to the VPC and allow resources in a private subnet to access the internet via IPv6. Which design should be used?

A.Allocate an IPv6 CIDR block and add a route to an Internet Gateway from the private subnet.

B.Use a NAT instance with IPv6 support in a public subnet.

C.Allocate an IPv6 CIDR block and use a NAT Gateway for IPv6 traffic.

D.Allocate an IPv6 CIDR block, create an egress-only Internet Gateway, and add a route to it from the private subnet.

AnswerD

Egress-only IGW allows outbound IPv6 traffic but blocks inbound.

Why this answer

An egress-only Internet Gateway (EIGW) is the correct AWS-managed service for enabling outbound-only IPv6 traffic from a VPC's private subnet to the internet, while preventing any unsolicited inbound connections. Unlike an Internet Gateway (IGW), which allows bidirectional traffic, an EIGW is specifically designed for IPv6 and ensures that resources in private subnets can initiate outbound connections without being directly reachable from the internet.

Exam trap

The trap here is that candidates confuse the egress-only Internet Gateway with a NAT Gateway or assume that a standard Internet Gateway can be used for private subnets, not realizing that IPv6 requires a different outbound-only mechanism to maintain subnet privacy.

How to eliminate wrong answers

Option A is wrong because adding a route to an Internet Gateway from a private subnet would make the subnet effectively public, allowing inbound IPv6 traffic and violating the requirement for a private subnet. Option B is wrong because NAT instances do not support IPv6; NAT is an IPv4-only function, and AWS NAT Gateways/instances cannot translate IPv6 traffic. Option C is wrong because a NAT Gateway is designed for IPv4 traffic only and does not support IPv6; using it for IPv6 would fail to provide connectivity.

Practice this question →

111

MCQhard

A company has a VPC with public and private subnets. They want to provide outbound internet access to instances in private subnets while preventing inbound internet traffic. The solution must be highly available and scale automatically. Which combination of services should be used?

A.NAT instances in each Availability Zone

B.VPC endpoint for S3 and DynamoDB

C.Internet Gateway attached to the VPC with route tables pointing to the Internet Gateway

D.NAT Gateway in each Availability Zone with route tables pointing to the NAT Gateway

AnswerD

NAT Gateways are managed, highly available within an AZ, and scale automatically. Using one per AZ provides AZ-level redundancy.

Why this answer

D is correct because a NAT Gateway in each Availability Zone provides highly available, automatically scaling outbound internet access for private subnets while blocking unsolicited inbound traffic. NAT Gateways are managed by AWS, scale up to 45 Gbps, and are redundant per AZ, meeting the requirements for high availability and automatic scaling without manual intervention.

Exam trap

The ANS-C01 exam often tests the misconception that a single NAT Gateway in one Availability Zone provides high availability, but the trap is that high availability requires a NAT Gateway in each Availability Zone to survive an AZ failure, as a single NAT Gateway is a single point of failure within its zone.

How to eliminate wrong answers

Option A is wrong because NAT instances are single EC2 instances that require manual configuration for high availability (e.g., auto-scaling groups, health checks) and do not automatically scale; they also have bandwidth limits based on instance type. Option B is wrong because VPC endpoints for S3 and DynamoDB provide private connectivity to those specific AWS services, not general outbound internet access to all destinations. Option C is wrong because an Internet Gateway attached to the VPC with route tables pointing to it would allow inbound internet traffic to private subnets, violating the requirement to prevent inbound traffic; Internet Gateways are used for public subnets, not private subnets needing outbound-only access.

Practice this question →

112

MCQeasy

A network engineer runs the AWS CLI command shown in the exhibit. The VPC has an Amazon Route 53 private hosted zone associated. What is the impact of this setting?

A.No instances in the VPC can resolve DNS records from the private hosted zone.

B.Only instances in public subnets can resolve private hosted zone records.

C.The DHCP option set must be updated to provide DNS resolution.

D.The private hosted zone is automatically deleted.

AnswerA

DNS support disabled means no DNS resolution via VPC.

Why this answer

The AWS CLI command shown in the exhibit sets the `enableDnsHostnames` and `enableDnsSupport` attributes to `false` for the VPC. When `enableDnsSupport` is false, Amazon Route 53 private hosted zones cannot be resolved by instances within that VPC because the VPC's DNS resolution is disabled entirely. This means no instances in the VPC can query the Route 53 Resolver for private hosted zone records, making option A correct.

Exam trap

The trap here is that candidates often confuse `enableDnsHostnames` (which controls instance hostname assignment) with `enableDnsSupport` (which controls DNS resolution), or assume that DHCP option sets can independently enable private hosted zone resolution without the VPC-level DNS support being enabled.

How to eliminate wrong answers

Option B is wrong because disabling DNS support (`enableDnsSupport: false`) affects all instances in the VPC regardless of subnet type; public subnets do not bypass this VPC-level setting. Option C is wrong because the DHCP option set cannot override the VPC-level `enableDnsSupport` attribute; even if the DHCP option set specifies custom DNS servers, the VPC's DNS resolution must be enabled for Route 53 private hosted zones to work. Option D is wrong because the private hosted zone is not automatically deleted when DNS support is disabled; it remains associated with the VPC but becomes non-functional until DNS support is re-enabled.

Practice this question →

113

MCQmedium

A company has an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The tunnel status is up, but traffic from on-premises cannot reach an EC2 instance in the VPC. The instance's security group allows inbound traffic from the on-premises CIDR. Which configuration should be checked first?

A.Ensure the VPN connection is attached to a transit gateway instead of a virtual private gateway.

B.Check the network ACL associated with the EC2 instance's subnet to ensure it allows inbound traffic from on-premises.

C.Verify that the VPC route table includes a route to the on-premises CIDR with the VPN gateway as target.

D.Confirm that BGP session is established and exchanging routes.

AnswerC

Traffic from on-premises enters the VPC via VPN, but the return traffic needs a route back to the VPN gateway.

Why this answer

For traffic from on-premises to reach an EC2 instance in a VPC via a Site-to-Site VPN, the VPC route table must contain a route pointing the on-premises CIDR to the VPN gateway (virtual private gateway or transit gateway). Without this route, the VPC has no path to send return traffic back to on-premises, causing asymmetric routing and connectivity failure even if the tunnel is up.

Exam trap

The trap here is that candidates often jump to checking BGP or tunnel status first, but the tunnel being up only confirms Layer 3 connectivity between the VPN endpoints, not that the VPC has a valid route to forward traffic back to on-premises.

How to eliminate wrong answers

Option A is wrong because the VPN connection can be attached to either a transit gateway or a virtual private gateway; the attachment type is not the primary issue when the tunnel is up but traffic fails. Option B is wrong because network ACLs are stateless and must allow both inbound and outbound traffic, but the question states the security group (stateful) already allows inbound from on-premises; the more common first check is the route table, not the NACL. Option D is wrong because if the tunnel status is up, BGP may or may not be used (static routes are also possible); even if BGP is established, the VPC route table still needs a route to the on-premises CIDR, so checking BGP first is premature.

Practice this question →

114

MCQmedium

A company has a VPC with multiple subnets. They want to monitor all network traffic to and from an EC2 instance for troubleshooting. Which AWS service should they use?

A.Amazon Inspector

B.AWS Config

C.VPC Flow Logs

D.AWS CloudTrail

AnswerC

VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. This makes it the correct service for monitoring all network traffic to and from an EC2 instance for troubleshooting purposes.

Exam trap

The trap here is that candidates often confuse VPC Flow Logs (which capture network traffic metadata) with AWS CloudTrail (which captures API calls), leading them to incorrectly select CloudTrail when the question specifically asks about monitoring network traffic to and from an EC2 instance.

How to eliminate wrong answers

Option A is wrong because Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not a tool for capturing raw network traffic logs. Option B is wrong because AWS Config evaluates and records resource configuration changes and compliance against rules, but it does not capture or log network traffic flows. Option D is wrong because AWS CloudTrail records API activity and management events for governance and auditing, not the actual network packets or flow-level traffic data.

Practice this question →

115

MCQeasy

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking a suboptimal path through the on-premises network instead of staying within AWS. What is the MOST likely cause?

A.The Transit Gateway route tables do not have a route for the destination VPC CIDR, so traffic is sent to the on-premises network via a default route.

B.The subnet route tables in each VPC have a route pointing to the other VPC's CIDR via the Internet Gateway.

C.The VPCs are peered directly, bypassing the Transit Gateway.

D.Security groups are blocking traffic between the VPCs.

AnswerA

Correct: Missing route causes blackhole or fallback to default route.

Why this answer

When a Transit Gateway route table lacks a specific route for the destination VPC CIDR, traffic destined for that VPC is evaluated against the remaining routes. If a default route (0.0.0.0/0) exists pointing to an on-premises network attachment (e.g., a VPN or Direct Connect), the traffic will be forwarded over that path, resulting in a suboptimal route that leaves AWS and re-enters through the on-premises network. This is the most likely cause because the Transit Gateway performs destination-based routing, and missing a specific VPC route forces fallback to the default route.

Exam trap

The trap here is that candidates often assume suboptimal routing is caused by asymmetric routing or security group misconfigurations, but the real issue is a missing specific route in the Transit Gateway route table, causing fallback to a default route that sends traffic on-premises.

How to eliminate wrong answers

Option B is wrong because a subnet route table pointing to an Internet Gateway for another VPC's CIDR would send traffic to the internet, not to the other VPC, and would not cause suboptimal routing through on-premises; it would simply break connectivity. Option C is wrong because if the VPCs were peered directly, traffic would stay within AWS and not traverse the on-premises network, contradicting the observed suboptimal path. Option D is wrong because security groups operate at the instance level (stateful packet filtering) and do not influence routing decisions; they can block traffic but cannot cause traffic to take a different network path.

Practice this question →

116

Multi-Selecthard

Which THREE are benefits of using AWS Transit Gateway over VPC peering in a multi-VPC environment? (Select THREE.)

Select 3 answers

A.Centralized management of network policies

B.Higher bandwidth per connection

C.Simpler configuration for a few VPCs

D.Lower cost compared to VPC peering

E.Transitive routing between all attached VPCs

.Ability to attach VPN and Direct Connect connections

AnswersA, E

Correct. Centralized management allows consistent policy enforcement across multiple VPCs.

Why this answer

AWS Transit Gateway offers a hub-and-spoke architecture that provides three key benefits over VPC peering: (1) the ability to attach VPN connections and Direct Connect virtual interfaces, enabling hybrid connectivity; (2) centralized management of network policies such as routing, security, and access controls from a single point; and (3) transitive routing between all attached VPCs, eliminating the need for full mesh peering.

Exam trap

AWS often tests the misconception that Transit Gateway always reduces cost or complexity compared to VPC peering, but the trap here is that for small numbers of VPCs (e.g., 2-3), VPC peering is simpler and cheaper, while Transit Gateway's benefits (centralized management, transitive routing, hybrid connectivity) only become advantageous at scale.

Practice this question →

117

MCQeasy

A company is designing a network for a three-tier web application in a single VPC. The web tier must be accessible from the internet, but the application and database tiers must not have direct internet access. The application servers need to make outbound calls to a third-party API. Which architecture meets these requirements?

A.Web servers in public subnets, application and database servers in private subnets with an internet gateway for outbound traffic.

B.All servers in public subnets with security groups restricting access.

C.Web servers in public subnets with an Application Load Balancer, application servers in private subnets with a NAT gateway, and database servers in private subnets.

D.All servers in private subnets and a VPN connection to the internet.

AnswerC

This follows best practices for a three-tier architecture.

Why this answer

It places web servers in public subnets with an Application Load Balancer for inbound internet traffic, while application and database servers reside in private subnets without direct internet access. A NAT gateway in a public subnet enables the application servers to initiate outbound connections to a third-party API, with return traffic automatically routed back, meeting the requirement for outbound-only internet access.

Exam trap

The trap here is that candidates often confuse an internet gateway with a NAT gateway, assuming an internet gateway can provide outbound-only access from private subnets, but an internet gateway requires public IPs and allows bidirectional traffic, while a NAT gateway specifically enables outbound-only traffic from private subnets.

How to eliminate wrong answers

Option A is wrong because an internet gateway in a private subnet does not provide outbound-only access; internet gateways require a public IP and route table entry for bidirectional traffic, which would expose private instances to inbound internet traffic, violating the no-direct-internet-access requirement. Option B is wrong because placing all servers in public subnets, even with security groups, still assigns public IPs and allows potential inbound internet access to application and database servers, failing the requirement to restrict their internet access. Option D is wrong because a VPN connection to the internet would route all traffic through a VPN, but private subnets without a NAT gateway or internet gateway cannot initiate outbound connections to the internet; the VPN alone does not provide outbound internet access for private instances.

Practice this question →

118

MCQhard

A company is designing a hybrid network with a Direct Connect connection. The VPC has multiple subnets that need to communicate with on-premises. The company wants to use a single VIF for both private and public traffic. Which type of VIF should be used?

A.Public VIF

B.Hosted VIF

C.A single VIF cannot carry both private and public traffic

D.Private VIF

AnswerC

Private and public VIFs are separate; you need two VIFs.

Why this answer

A single Virtual Interface (VIF) on an AWS Direct Connect connection is designed to carry either private traffic (VPC-to-on-premises via private IPs) or public traffic (to AWS public services like S3, DynamoDB via public IPs), but not both simultaneously. This is because a Private VIF uses BGP to exchange routes over private IP addresses within a VPC, while a Public VIF uses BGP to exchange routes for AWS public IP prefixes. The two traffic types require separate BGP sessions and separate VLANs, making it impossible to combine them into one VIF.

Exam trap

The trap here is that candidates assume a single VIF can be 'multiplexed' to carry both private and public traffic, similar to a VPN tunnel, but AWS Direct Connect enforces strict separation between Private and Public VIFs at the BGP and VLAN level.

How to eliminate wrong answers

Option A is wrong because a Public VIF only provides access to AWS public services (e.g., S3, DynamoDB) using public IP addresses and cannot route traffic to private VPC subnets. Option B is wrong because a Hosted VIF is a type of VIF provided by an AWS Direct Connect Partner, but it still functions as either a Private or Public VIF and cannot carry both traffic types simultaneously. Option D is wrong because a Private VIF only connects to a single VPC using private IP addresses and cannot carry traffic to AWS public endpoints.

Practice this question →

119

MCQeasy

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via AWS Direct Connect. They need to ensure that traffic between VPCs is inspected by a centralized security appliance. How should they design the routing?

A.Use Network ACLs on the subnets to restrict traffic and allow inspection.

B.Create VPC peering connections between all VPCs and route traffic through a security appliance in a central VPC.

C.Use security groups on the security appliance to inspect traffic.

D.Create a Transit Gateway with separate route tables. Attach each VPC and the Direct Connect virtual interface to the Transit Gateway. In the route tables, propagate routes and add static routes to send inter-VPC traffic to the security appliance VPC.

AnswerD

Transit Gateway route tables allow you to centralize routing through an inspection VPC.

Why this answer

AWS Transit Gateway supports separate route tables, allowing you to isolate traffic domains. By attaching each VPC and the Direct Connect virtual interface to the Transit Gateway, you can create a centralized inspection VPC. Static routes in the Transit Gateway route tables direct inter-VPC traffic to the security appliance VPC, ensuring all traffic between VPCs is inspected before reaching its destination.

Exam trap

The trap here is that candidates often confuse the transitive routing capability of Transit Gateway with VPC peering, assuming VPC peering can route through a central VPC, but VPC peering does not support transitive routing, making Option B invalid.

How to eliminate wrong answers

Option A is wrong because Network ACLs are stateless and operate at the subnet level, not at the routing level; they cannot redirect traffic to a centralized security appliance for inspection. Option B is wrong because VPC peering connections do not support transitive routing, meaning traffic between VPCs cannot be routed through a central VPC without complex and non-scalable configurations. Option C is wrong because security groups are stateful and apply to individual ENIs, not to routing; they can filter traffic but cannot force traffic to traverse a security appliance for inspection.

Practice this question →

120

MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to communicate with an on-premises server using an IPsec VPN. The company has set up a Virtual Private Gateway (VGW) and a Customer Gateway (CGW) with a Site-to-Site VPN connection. The VPN tunnel is established. However, the EC2 instance cannot ping the on-premises server. The security groups and network ACLs allow all traffic. What is the most likely cause?

A.The VGW is not configured with the correct BGP ASN

B.The VGW is not attached to the VPC

C.The VPN tunnel is not in the UP state

D.The private subnet route table does not have a route for the on-premises CIDR pointing to the VGW

AnswerD

Without this route, traffic from the instance to on-premises is dropped.

Why this answer

The most likely cause is that the private subnet's route table lacks a route for the on-premises CIDR pointing to the Virtual Private Gateway (VGW). Even though the VPN tunnel is established, traffic from the EC2 instance in the private subnet will be dropped at the subnet level if there is no explicit route directing the on-premises destination to the VGW. Security groups and network ACLs are permissive, so the issue is routing, not filtering.

Exam trap

The ANS-C01 exam often tests the misconception that a VPN tunnel being 'UP' automatically allows traffic, but in AWS, you must also configure the route tables in the VPC to direct traffic to the VGW for the remote network.

How to eliminate wrong answers

Option A is wrong because the BGP ASN is only relevant for dynamic routing (BGP) configuration; the VPN tunnel can be established and function with static routing, and an incorrect BGP ASN would not prevent ping if the tunnel is up and routes are in place. Option B is wrong because if the VGW were not attached to the VPC, the VPN connection would not have been created or the tunnel would not establish; the question states the VPN tunnel is established, implying the VGW is attached. Option C is wrong because the question explicitly states 'The VPN tunnel is established,' so the tunnel is in the UP state; a down tunnel would prevent all communication, but here the issue is routing, not tunnel status.

Practice this question →

121

MCQhard

A company has a VPC with multiple subnets across two AZs. The VPC is connected to an on-premises data center via AWS Direct Connect. The company wants to ensure that traffic between the VPC and on-premises is load-balanced across two Direct Connect virtual interfaces (VIFs) for high availability. Which configuration should be used?

A.Configure two VIFs and use BGP to advertise the same prefixes with equal metrics to enable ECMP.

B.Configure a VPN connection over each VIF and use equal-cost routes between the VPN tunnels.

C.Configure a single Direct Connect VIF with a 10 Gbps connection and a single BGP session.

D.Configure two VIFs with static routes pointing to different on-premises IPs.

AnswerA

BGP ECMP allows load balancing across multiple VIFs.

Why this answer

Configuring two Direct Connect virtual interfaces (VIFs) with BGP and advertising the same prefixes with equal metrics (e.g., equal MED or AS-path length) enables Equal-Cost Multi-Path (ECMP) routing. This allows the VPC and on-premises routers to load-balance traffic across both VIFs, providing high availability and active-active utilization of the Direct Connect connections.

Exam trap

The trap here is that candidates often assume VPN tunnels are required for load-balancing or that a single high-bandwidth connection is sufficient, missing the core requirement for active-active load-balancing and high availability via BGP ECMP across multiple VIFs.

How to eliminate wrong answers

Option B is wrong because VPN tunnels over Direct Connect add unnecessary complexity and overhead (IPsec encryption) without providing load-balancing benefits; ECMP is natively supported with BGP over Direct Connect VIFs, not requiring VPN. Option C is wrong because a single VIF, even at 10 Gbps, creates a single point of failure and does not provide load-balancing or high availability across multiple connections. Option D is wrong because static routes cannot dynamically load-balance or failover; they lack the ability to perform ECMP or react to link failures without manual intervention, unlike BGP which supports path selection and equal-cost multipathing.

Practice this question →

122

MCQmedium

A company is designing a multi-account architecture using AWS Transit Gateway. They need to isolate development and production environments but allow shared services account access to both. What is the most scalable and secure design?

A.Use a single Transit Gateway and configure separate route tables for each environment, attaching VPCs from each account.

B.Use a single Transit Gateway with one route table for all environments and implement security groups to isolate traffic.

C.Create two Transit Gateways: one for development and one for production. Share the Transit Gateways with the shared services account via AWS Resource Access Manager.

D.Use VPC Peering between each VPC and the shared services VPC, and set up Internet Gateway for each environment.

AnswerC

Correct: Separate Transit Gateways provide full isolation, and RAM enables shared services.

Why this answer

Using two separate Transit Gateways (one for dev, one for prod) provides complete network isolation between environments at the routing layer, while AWS Resource Access Manager (RAM) allows the shared services account to attach its VPC to both Transit Gateways. This design is scalable as each environment can grow independently without route table conflicts, and secure because there is no transitive routing path between dev and prod. A single Transit Gateway with separate route tables (Option A) still shares the same data plane, introducing risk of misconfiguration or route leaks, whereas two Transit Gateways enforce hard isolation.

Exam trap

The trap here is that candidates assume separate route tables on a single Transit Gateway provide full isolation, but AWS explicitly warns that route tables share the same data plane and misconfigurations can leak traffic, so the exam expects two Transit Gateways for hard isolation between environments.

How to eliminate wrong answers

Option A is wrong because a single Transit Gateway, even with separate route tables, shares the same forwarding plane and can allow unintended transitive routing if a route is accidentally propagated or a VPC is attached to the wrong route table, violating the isolation requirement. Option B is wrong because using one route table for all environments eliminates isolation entirely, and security groups operate at the instance level (L4) not the network layer, so they cannot prevent traffic from traversing the Transit Gateway between environments. Option D is wrong because VPC Peering is a 1:1 connection that does not scale to many VPCs, requires managing N*(N-1)/2 peering relationships, and does not support transitive routing, making it impractical for a multi-account architecture with shared services.

Practice this question →

123

MCQeasy

A company is designing a VPC for a three-tier application (web, application, database). The database tier should not be accessible from the internet, but the web tier must be accessible. Which subnet design should the network engineer use?

A.Place web and app servers in public subnets, and database servers in private subnets.

B.Place all servers in private subnets and use a NAT Gateway for internet access.

C.Place web servers in public subnets with an internet gateway, and app and database servers in private subnets.

D.Place all servers in public subnets and rely on security group rules to restrict access.

AnswerC

This follows the traditional security model of isolation for backend tiers.

Why this answer

It places the web servers in a public subnet with an Internet Gateway (IGW) to allow inbound HTTP/HTTPS traffic from the internet, while the application and database servers are placed in private subnets with no direct internet path. This design ensures the database tier is isolated from the internet, meeting the security requirement, while the web tier remains accessible. The application servers can communicate with the database via private IP addresses within the VPC, and outbound internet access for the private subnets (if needed) can be provided through a NAT Gateway in a public subnet.

Exam trap

The trap here is that candidates often assume placing all servers in private subnets with a NAT Gateway provides inbound internet access, confusing outbound-only NAT with the inbound access required for the web tier, or they mistakenly think security groups alone can fully replace subnet-level isolation in a public subnet.

How to eliminate wrong answers

Option A is wrong because placing both web and app servers in public subnets exposes the application tier to the internet unnecessarily, increasing the attack surface and violating the principle of least privilege; the app tier should remain private to mediate traffic between web and database tiers. Option B is wrong because placing all servers in private subnets with a NAT Gateway only provides outbound internet access, not inbound access from the internet; the web tier would not be accessible to external users without an Internet Gateway and a public subnet. Option D is wrong because placing all servers in public subnets and relying solely on security group rules does not prevent direct internet access to the application and database tiers; security groups are stateful firewalls but do not replace the network-level isolation provided by private subnets, and a misconfiguration could expose sensitive tiers.

Practice this question →

124

MCQhard

A Network Engineer is troubleshooting a cross-account VPC endpoint connection. The service provider account (123456789012) has the above IAM policy attached to the endpoint service. The consumer account (111111111111) has created a VPC endpoint (vpce-abc123) and is trying to accept the connection. The consumer receives an 'AccessDenied' error when calling ec2:AcceptVpcEndpointConnections. What is the MOST likely cause?

A.The policy action should be 'ec2:CreateVpcEndpoint' instead.

B.The policy condition 'aws:SourceArn' does not match the consumer's endpoint ARN.

C.The policy resource ARN is incorrect; it should be the endpoint service ARN.

D.The consumer account does not have permission to accept the connection; only the service provider can accept.

AnswerD

The AcceptVpcEndpointConnections API is called by the service provider, not the consumer. The consumer must wait for the provider to accept.

Why this answer

The 'AccessDenied' error occurs because the consumer account (111111111111) is attempting to call ec2:AcceptVpcEndpointConnections, which is an API action that only the service provider account (123456789012) can perform. The IAM policy shown is attached to the endpoint service in the provider account, but the consumer does not have permission to accept its own connection; instead, the provider must accept the endpoint connection request. This is a fundamental AWS VPC endpoint service behavior where the provider controls acceptance, not the consumer.

Exam trap

The ANS-C01 exam often tests the misconception that the consumer can accept its own VPC endpoint connection, but in reality, only the service provider account has permission to call AcceptVpcEndpointConnections, regardless of IAM policies attached to the consumer.

How to eliminate wrong answers

Option A is wrong because ec2:CreateVpcEndpoint is used to create a VPC endpoint, not to accept a connection; the consumer already created the endpoint (vpce-abc123), and the error is on the accept action. Option B is wrong because the 'aws:SourceArn' condition is used to restrict which consumer endpoint ARN can connect, but it does not cause an 'AccessDenied' on the accept API call; the error here is about permissions to call AcceptVpcEndpointConnections, not about the condition matching. Option C is wrong because the policy resource ARN should be the endpoint service ARN (e.g., arn:aws:ec2:region:123456789012:vpc-endpoint-service/vpce-svc-xxx), not the consumer's endpoint ARN; however, the core issue is that the consumer lacks permission to call the accept action, not the resource ARN.

Practice this question →

125

MCQmedium

A company has a VPC with a CIDR of 10.0.0.0/16. It has two public subnets (10.0.1.0/24 and 10.0.2.0/24) and two private subnets (10.0.3.0/24 and 10.0.4.0/24). The company hosts a web application on EC2 instances in the private subnets behind an Application Load Balancer (ALB) in the public subnets. The ALB is internet-facing. The company wants to add a second ALB in the same VPC for a different application but using the same public subnets. The new ALB also needs to be internet-facing. However, when the company tries to create the new ALB, they receive an error: 'The subnet 'subnet-xxxxxxxx' does not have enough free IP addresses to satisfy the request.' The network engineer checks the subnets and finds that the public subnets have only 2 free IP addresses each. The private subnets have plenty of free IP addresses. The company wants to resolve this error without changing the architecture of the existing applications. What should the network engineer do?

A.Create new public subnets with larger CIDR blocks (e.g., /23) and associate them with the same route table.

B.Use the private subnets for the new ALB and add a NAT gateway for internet access.

C.Reduce the size of the existing public subnets by modifying their CIDR blocks.

D.Launch a NAT gateway in one public subnet to free up IP addresses.

AnswerA

New public subnets provide more IP addresses.

Why this answer

The error indicates insufficient free IP addresses in the public subnets. Creating new public subnets with larger CIDR blocks (e.g., /23) provides more IP addresses without affecting the existing subnets or architecture. Option B is incorrect because private subnets cannot host an internet-facing ALB (they lack direct internet access and cannot assign public IPs).

Option C would reduce available IPs and disrupt existing resources. Option D does not free up IP addresses in the subnets.

Practice this question →

126

Multi-Selectmedium

A company is deploying a web application across multiple Availability Zones in a single AWS Region. The application consists of an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group, and an Amazon RDS Multi-AZ database. The company needs to ensure that the application can survive the loss of an entire Availability Zone. Which THREE actions should they take? (Select THREE.)

Select 3 answers

A.Use larger EC2 instance types to handle the load

B.Configure the Auto Scaling group to launch instances in at least two Availability Zones

C.Configure the Application Load Balancer to be internet-facing and enable cross-zone load balancing

D.Enable Multi-AZ deployment for the RDS database

E.Deploy a single NAT Gateway in one AZ for outbound traffic

AnswersB, C, D

Ensures instances are spread across AZs.

Why this answer

Configuring the Auto Scaling group to launch instances in at least two Availability Zones ensures that if one AZ fails, the remaining AZ(s) still have healthy EC2 instances to serve traffic. This is a fundamental requirement for multi-AZ high availability, as the Auto Scaling group will automatically replace failed instances in the remaining AZs.

Exam trap

AWS often tests the misconception that simply enabling cross-zone load balancing on the ALB (Option C) alone is sufficient for AZ resilience, but without the Auto Scaling group spanning multiple AZs (Option B), there would be no healthy targets in the surviving AZs to route traffic to.

Practice this question →

127

Multi-Selecteasy

A company wants to enable communication between two VPCs (VPC A and VPC B) in the same AWS account and region. They want to use private IP addresses and avoid using the internet. Which THREE options can achieve this?

Select 3 answers

A.VPC peering connection

B.AWS Site-to-Site VPN connection between VPCs

C.Internet gateway attached to both VPCs

D.AWS Transit Gateway

E.NAT gateway in each VPC

AnswersA, B, D

Direct private connection between VPCs.

Why this answer

VPC peering connection (Option A) allows direct, private IP connectivity between two VPCs using the AWS global network, with no internet gateway or VPN required. Traffic stays within AWS's internal infrastructure, meeting the requirement for private IP addresses and avoiding the internet.

Exam trap

The trap here is that candidates confuse a NAT gateway with a VPC-to-VPC connectivity solution, but NAT gateways only handle outbound internet traffic and cannot forward traffic between VPCs.

Practice this question →

128

MCQhard

A company uses AWS Direct Connect with a private VIF to connect its data center to a VPC. The VPC has multiple subnets. The on-premises network team reports that they can ping the VPC's private IP addresses but cannot connect to an EC2 instance's port 443. The EC2 instance's security group allows HTTPS from the on-premises CIDR. What should the engineer check NEXT?

A.Check the security group's inbound rules for port 443.

B.Confirm that the Direct Connect virtual interface is in the 'up' state.

C.Check the EC2 instance's operating system firewall (e.g., iptables, Windows Firewall) to see if port 443 is blocked.

D.Verify that the route tables in the VPC have a route back to the on-premises CIDR.

AnswerC

OS firewall can block even if security group allows.

Why this answer

Since the on-premises team can ping the EC2 instance (ICMP works) but cannot connect to port 443 (HTTPS), the network path is functional at Layer 3. The security group already allows HTTPS from the on-premises CIDR, so the next logical step is to check the EC2 instance's OS-level firewall (e.g., iptables, Windows Firewall), which operates at Layer 4 and can independently block TCP port 443 even when the security group permits it.

Exam trap

The trap here is that candidates assume security group rules are the only firewall layer, overlooking the instance's OS firewall, which can independently block specific ports even when Layer 3 connectivity (ICMP) works.

How to eliminate wrong answers

Option A is wrong because the question states the security group already allows HTTPS from the on-premises CIDR, so rechecking it would be redundant and not address the issue. Option B is wrong because ping success confirms the Direct Connect virtual interface is up and passing traffic, so checking the VIF state again is unnecessary. Option D is wrong because ping works, which proves the VPC route tables have a return route to the on-premises CIDR; if the route were missing, ICMP echo replies would not return.

Practice this question →

129

MCQmedium

A company has a web application behind an Application Load Balancer (ALB) in a VPC. The ALB is internet-facing and has a security group that allows inbound HTTP/HTTPS from 0.0.0.0/0. The EC2 instances are in a private subnet with a security group that allows inbound traffic only from the ALB's security group. The application works correctly. However, the security team wants to add an additional layer of protection by using AWS WAF. What is the best way to integrate AWS WAF with the ALB to filter malicious requests?

A.Create a web ACL in AWS WAF and associate it with the ALB.

B.Replace the ALB with a Network Load Balancer and use AWS WAF with it.

C.Configure the security group of the ALB to only allow traffic that passes AWS WAF inspection.

D.Use AWS WAF in front of Amazon CloudFront and then forward requests to the ALB.

AnswerA

WAF can be associated with ALB to filter HTTP/HTTPS requests.

Why this answer

AWS WAF can be associated directly with an ALB to filter incoming requests before they reach the ALB. Option B is incorrect because WAF works at the application layer, not at CloudFront unless CloudFront is used. Option C is incorrect because WAF is not applied at the security group level.

Option D is incorrect because WAF is not a Network Load Balancer feature.

Practice this question →

130

MCQeasy

A company is deploying an application that must use IPv6 for internet-facing traffic. The VPC is currently using IPv4 only. What is the simplest way to enable IPv6?

A.Use an egress-only internet gateway for IPv6 traffic.

B.Associate an IPv6 CIDR block with the VPC and subnets, and update route tables to route IPv6 traffic to an internet gateway.

C.Deploy a NAT64 device to translate IPv6 to IPv4.

D.Set up a VPN connection to an ISP that provides IPv6.

AnswerB

Simplest way to enable IPv6.

Why this answer

The simplest way to enable IPv6 in an existing IPv4-only VPC is to associate an IPv6 CIDR block (e.g., an Amazon-provided /56) with the VPC and subnets, then update the route tables to direct IPv6 traffic (::/0) to an internet gateway. This requires no additional translation or complex infrastructure, as the internet gateway is already dual-stack capable and can handle both IPv4 and IPv6 traffic natively.

Exam trap

The trap here is that candidates confuse the egress-only internet gateway (which is only for outbound IPv6 from private subnets) with the standard internet gateway, or mistakenly think a translation mechanism like NAT64 is required, when in fact the simplest solution is to add an IPv6 CIDR and route to the existing internet gateway.

How to eliminate wrong answers

Option A is wrong because an egress-only internet gateway is used for outbound-only IPv6 traffic from private subnets, not for enabling general internet-facing IPv6 traffic, and it does not allow inbound connections. Option C is wrong because a NAT64 device translates IPv6 to IPv4, which is unnecessary when the goal is to use native IPv6; it adds complexity and latency, and is typically used only when an application cannot be made dual-stack. Option D is wrong because setting up a VPN connection to an ISP that provides IPv6 is overly complex, introduces additional latency, and does not integrate with the VPC's native IPv6 capabilities; the VPC can directly use an IPv6 CIDR and internet gateway without external VPNs.

Practice this question →

131

MCQmedium

A company is designing a multi-VPC architecture with VPC peering. They need to ensure that traffic between VPCs in different AWS Regions is encrypted. Which solution should they use?

A.Direct Connect gateway with VIFs

B.Transit Gateway VPN attachments

C.VPC peering with VPN encryption

D.Transit Gateway inter-Region peering

AnswerD

Transit Gateway inter-Region peering encrypts traffic automatically.

Why this answer

Transit Gateway inter-Region peering is the correct solution because it provides encrypted traffic between VPCs in different AWS Regions natively, using the AWS global network infrastructure with automatic encryption at the transport layer. This feature supports transitive routing and does not require additional VPN tunnels or third-party appliances, making it the most efficient and scalable option for multi-region VPC connectivity.

Exam trap

AWS often tests the misconception that VPC peering alone provides encryption, or that VPN attachments are required for inter-Region encryption, when in fact Transit Gateway inter-Region peering natively encrypts traffic without additional VPN layers.

How to eliminate wrong answers

Option A is wrong because Direct Connect gateway with VIFs provides private connectivity to AWS but does not inherently encrypt traffic between VPCs in different Regions; it requires additional VPN or MACsec for encryption. Option B is wrong because Transit Gateway VPN attachments are designed for site-to-site VPN connections between on-premises networks and AWS, not for inter-Region VPC peering, and they would introduce unnecessary complexity and latency. Option C is wrong because VPC peering with VPN encryption is not a native AWS feature; VPC peering itself does not support encryption, and adding a VPN overlay would require manual configuration of VPN appliances, which is not a recommended or scalable solution for inter-Region traffic.

Practice this question →

132

MCQhard

A company runs a multi-tier web application in a VPC with public and private subnets across two Availability Zones. The web tier uses an Application Load Balancer (ALB) in the public subnets, and the application tier uses EC2 instances in private subnets. The database tier uses an RDS MySQL Multi-AZ instance in private subnets. The company has implemented a network ACL (NACL) on the private subnets to allow only traffic from the ALB security group. Recently, the application tier instances are unable to connect to the RDS database. The security group for RDS allows inbound traffic on port 3306 from the application tier security group. The network team has verified that the application tier instances can reach the internet through a NAT Gateway. What is the MOST likely cause of the connectivity issue?

A.The NACL on the private subnets is blocking outbound traffic from the application tier to the RDS database.

B.The application tier instances are in a different Availability Zone than the RDS primary instance.

C.The NAT Gateway is blocking traffic to the RDS endpoint.

D.The RDS security group is not allowing inbound traffic from the application tier security group.

AnswerA

Correct: NACL's stateless nature requires explicit outbound rules for ephemeral ports.

Why this answer

The NACL on the private subnets is stateful only for inbound rules; outbound traffic is evaluated separately. Since the NACL allows only inbound traffic from the ALB security group but does not have an outbound rule permitting traffic from the application tier to the RDS database (port 3306), the outbound SYN packets from the application instances are dropped, preventing the TCP handshake from completing.

Exam trap

The trap here is that candidates assume NACLs are stateful like security groups, leading them to overlook the need for explicit outbound rules for traffic initiated from within the subnet.

How to eliminate wrong answers

Option B is wrong because RDS Multi-AZ automatically handles failover across Availability Zones, and the application tier instances can connect to the RDS endpoint regardless of which AZ the primary instance is in; the issue is not AZ-specific. Option C is wrong because the NAT Gateway is used for outbound internet traffic, not for traffic within the VPC to RDS (which uses private IPs); the NAT Gateway is not in the path between the application tier and RDS. Option D is wrong because the question explicitly states that the RDS security group allows inbound traffic on port 3306 from the application tier security group, so this is not the cause.

Practice this question →

133

MCQeasy

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is inspected by a network virtual appliance. Which architecture should they use?

A.Use a Network Load Balancer in each VPC to forward traffic to the appliance.

B.Attach the appliance directly to each VPC using VPC Peering.

C.Create an inspection VPC with the appliance. Configure Transit Gateway route tables to send inter-VPC traffic to the inspection VPC attachment.

D.Place the appliance in each VPC and configure VPC Peering.

AnswerC

This allows traffic to be routed through the appliance for inspection.

Why this answer

It uses an inspection VPC as a central point for traffic inspection. By attaching the network virtual appliance to a dedicated inspection VPC and configuring Transit Gateway route tables to route inter-VPC traffic to that attachment, all traffic between VPCs is forced through the appliance for inspection. This leverages Transit Gateway's ability to route traffic between attachments based on route table entries, enabling centralized security enforcement without complex peering or per-VPC appliance deployments.

Exam trap

AWS often tests the misconception that you can simply attach a virtual appliance to a Transit Gateway and have it automatically inspect all traffic, but the trap here is that you must explicitly configure Transit Gateway route tables to route inter-VPC traffic to the inspection VPC attachment, otherwise traffic will flow directly between VPC attachments without inspection.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer (NLB) distributes traffic to targets but does not inherently inspect or route traffic between VPCs; it would require additional configuration and does not solve the need for centralized inspection across multiple VPCs. Option B is wrong because attaching the appliance directly to each VPC using VPC Peering creates a mesh of peering connections that is not scalable, does not centralize inspection, and violates the hub-and-spoke model that Transit Gateway is designed to provide. Option D is wrong because placing the appliance in each VPC and configuring VPC Peering leads to redundant appliances, increased management overhead, and does not leverage Transit Gateway's centralized routing capabilities, making it inefficient and costly.

Practice this question →

134

MCQhard

A company is designing a network for a multi-account architecture using AWS Resource Access Manager (RAM) to share VPC subnets across accounts. They want to ensure that instances in shared subnets can communicate with instances in the owner's VPC using private IP addresses. What is required?

A.Establish a VPC peering connection between the owner and participant accounts.

B.Configure a VPC endpoint for Amazon EC2 to allow cross-account private communication.

C.No additional networking configuration is required; the shared subnet is part of the same VPC.

D.Create a transit gateway and attach both VPCs to it.

AnswerC

Shared subnets are within the same VPC, so routing is inherent.

Why this answer

When you share a subnet using AWS Resource Access Manager (RAM), the shared subnet is part of the owner's VPC. Instances launched into that shared subnet reside in the same VPC as the owner's instances, so they can communicate using private IP addresses by default, with no additional networking configuration required. This is because VPC subnets are a logical subdivision of the VPC's CIDR block, and all instances within the same VPC can route to each other via the VPC's internal router.

Exam trap

The trap here is that candidates mistakenly think cross-account subnet sharing requires additional connectivity like VPC peering or a transit gateway, when in fact the shared subnet is logically part of the same VPC, so no extra networking is needed for private IP communication.

How to eliminate wrong answers

Option A is wrong because VPC peering is used to connect two separate VPCs, but a shared subnet is part of the same VPC as the owner, so peering is unnecessary and would add complexity without benefit. Option B is wrong because a VPC endpoint for EC2 is used to privately access EC2 APIs (e.g., for managing instances) and does not enable instance-to-instance private IP communication; it is a gateway for API calls, not for data-plane traffic between instances. Option D is wrong because a transit gateway is designed to interconnect multiple VPCs or on-premises networks, but since the shared subnet is already within the same VPC, there is no need for a transit gateway; it would introduce unnecessary cost and administrative overhead.

Practice this question →

135

Multi-Selecthard

A company has a VPC with public and private subnets. The public subnet contains a NAT gateway and a bastion host. The private subnet contains application servers. The company wants to ensure that the application servers can download patches from the internet. Which TWO steps should be taken to allow this while maintaining security? (Choose two.)

Select 2 answers

A.Allow outbound HTTPS (port 443) traffic from the application servers in the security group

B.Modify the network ACL of the private subnet to allow all outbound traffic

C.Add a route in the public subnet route table that points 0.0.0.0/0 to the NAT gateway

D.Add a route in the private subnet route table that points 0.0.0.0/0 to the NAT gateway

E.Associate an Elastic IP address with the NAT gateway

AnswersA, D

Correct; security groups must allow outbound traffic.

Why this answer

The application servers need to initiate outbound HTTPS connections (port 443) to download patches from the internet. By allowing outbound HTTPS traffic in the security group associated with the application servers, you permit the necessary traffic while maintaining stateful filtering and restricting other outbound traffic. This is a security best practice that follows the principle of least privilege.

Exam trap

AWS often tests the distinction between where routes are added (public vs. private subnet route tables) and the role of security groups versus network ACLs, leading candidates to incorrectly modify the public subnet's route table or use overly permissive network ACL rules.

Practice this question →

136

MCQeasy

A company is using AWS Client VPN to allow remote employees to access resources in a VPC. The VPN is configured with a server certificate and mutual authentication. Some users report that they cannot connect to the VPN. What should the administrator check FIRST?

A.Check the security group associated with the VPN endpoint.

B.Verify that the server certificate is uploaded to AWS Certificate Manager (ACM).

C.Confirm that the VPN endpoint is associated with all subnets in the VPC.

D.Verify that each user has a valid client certificate installed on their device.

AnswerD

Correct: Mutual authentication requires client certificates.

Why this answer

The question states that mutual authentication is configured, which requires both a server certificate and a valid client certificate on each user's device. Since some users cannot connect while others presumably can, the most likely issue is that the affected users lack a valid client certificate. The administrator should first verify that each user has a valid client certificate installed, as this is a common point of failure in mutual TLS authentication.

Exam trap

AWS often tests the distinction between server-side and client-side authentication requirements in mutual TLS; the trap here is that candidates assume the issue is with the server certificate or network configuration, overlooking that each user must have a valid client certificate for mutual authentication to succeed.

How to eliminate wrong answers

Option A is wrong because security groups are stateful and, by default, allow all outbound traffic; the VPN endpoint's security group controls inbound/outbound traffic but is not the first thing to check when users cannot connect, especially since the issue is likely client-side. Option B is wrong because the server certificate must be uploaded to ACM for the VPN endpoint to function, but if the VPN is already configured and working for some users, the server certificate is already in place; this would be a global issue, not a per-user issue. Option C is wrong because the VPN endpoint does not need to be associated with all subnets in the VPC; it only needs to be associated with at least one subnet to function, and associating it with all subnets is not required and would not cause per-user connectivity failures.

Practice this question →

137

MCQhard

A financial services company must meet PCI DSS compliance requirements. They have a VPC with public and private subnets. The web servers in the public subnets must only accept traffic from the internet on ports 80 and 443. The application servers in the private subnets must only accept traffic from the web servers. Which network design ensures least-privilege access?

A.Use security groups on web servers allowing 0.0.0.0/0 on ports 80/443, and on app servers allowing the web servers' CIDR block

B.Use a Network ACL on the public subnet allowing inbound ports 80 and 443 from 0.0.0.0/0, and security groups on web and app servers with the app servers' security group referencing the web servers' security group

C.Use a single Network ACL for both public and private subnets with allow rules for ports 80 and 443

D.Use a single Network ACL on the private subnet allowing inbound ports 80 and 443 from the public subnet CIDR

AnswerB

This provides least-privilege with stateful security groups and stateless NACL.

Why this answer

It uses security groups for stateful, least-privilege access control. The web servers' security group allows inbound ports 80 and 443 from 0.0.0.0/0, and the app servers' security group references the web servers' security group as the source, ensuring only traffic from the web servers is permitted. This design leverages security group chaining, which automatically handles return traffic and avoids the need for explicit CIDR management, aligning with PCI DSS least-privilege requirements.

Exam trap

The trap here is that candidates often default to using Network ACLs for subnet-level control, forgetting that security groups provide stateful, instance-level filtering with the ability to reference other security groups, which is more aligned with least-privilege and PCI DSS requirements.

How to eliminate wrong answers

Option A is wrong because allowing the web servers' CIDR block on the app servers' security group is less flexible and scalable than referencing the web servers' security group; it also fails to leverage stateful security group chaining, potentially requiring manual updates if web server IPs change. Option C is wrong because using a single Network ACL for both subnets would apply the same rules to all subnets, violating least-privilege by allowing inbound traffic from the internet to the private subnet and not differentiating between web and app server traffic. Option D is wrong because a Network ACL on the private subnet allowing inbound ports 80 and 443 from the public subnet CIDR is stateless, requiring explicit outbound rules for return traffic, and does not provide the granularity of security group references; it also unnecessarily exposes the private subnet to the entire public subnet CIDR.

Practice this question →

138

MCQhard

A company is designing a network for a real-time gaming application that requires low latency and high throughput between game servers in multiple regions. The application uses UDP traffic. Which AWS service should be used to route traffic between regions?

A.AWS Transit Gateway

B.AWS Global Accelerator

C.Amazon CloudFront

D.Amazon Route 53

AnswerB

Supports UDP and TCP, provides anycast IPs.

Why this answer

AWS Global Accelerator uses the Anycast IP address and the AWS global network to route UDP traffic from users to the optimal regional endpoint, minimizing latency and jitter. It is designed for real-time applications like gaming that require low-latency and high-throughput UDP traffic between regions, as it bypasses the public internet and leverages AWS's internal backbone.

Exam trap

The trap here is that candidates often confuse Amazon Route 53's latency-based routing with actual network path optimization, but Route 53 only controls DNS resolution and does not accelerate or route the UDP traffic itself after the initial connection.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway is a hub-and-spoke connectivity service for VPC-to-VPC or on-premises routing within a single region, not designed for inter-region traffic optimization or low-latency UDP routing. Option C is wrong because Amazon CloudFront is a content delivery network (CDN) optimized for HTTP/HTTPS traffic and does not support UDP traffic for real-time gaming applications. Option D is wrong because Amazon Route 53 is a DNS service that resolves domain names to IP addresses and can route traffic via policies like latency-based routing, but it does not optimize the network path or provide any acceleration for UDP traffic; it only controls initial DNS resolution.

Practice this question →

139

MCQhard

A company has a VPC with a public subnet and a private subnet. They have a NAT Gateway in the public subnet. Instances in the private subnet need to download patches from the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, instances cannot reach the internet. What is a possible cause?

A.The route table for the NAT Gateway's subnet does not have a route to an Internet Gateway.

B.The NAT Gateway is in a private subnet.

C.The network ACL on the private subnet is blocking outbound traffic.

D.The NAT Gateway does not have a security group allowing outbound traffic.

AnswerA

NAT Gateway needs a route to IGW for internet access.

Why this answer

For a NAT Gateway to route traffic to the internet, its subnet must have a route to an Internet Gateway (IGW). The NAT Gateway resides in the public subnet, and the public subnet's route table must include a default route (0.0.0.0/0) pointing to the IGW. Without this route, the NAT Gateway cannot forward traffic from the private subnet to the internet, even though the private subnet's route table correctly points to the NAT Gateway.

Exam trap

AWS often tests the misconception that configuring the private subnet's route table to point to the NAT Gateway is sufficient, while ignoring that the NAT Gateway's own subnet must have a route to the Internet Gateway for outbound connectivity.

How to eliminate wrong answers

Option B is wrong because the NAT Gateway is explicitly stated to be in the public subnet, and placing it in a private subnet would prevent it from reaching the internet, but that is not the scenario here. Option C is wrong because network ACLs are stateless and, by default, allow all outbound traffic; unless explicitly modified to block outbound traffic, they would not prevent internet access. Option D is wrong because NAT Gateways do not have security groups; they are managed by AWS and cannot be associated with security groups, so this is not a possible cause.

Practice this question →

140

MCQeasy

A company wants to provide internet access to instances in a private subnet using a NAT gateway. The NAT gateway is deployed in a public subnet with an Elastic IP. The private subnet route table has a default route pointing to the NAT gateway. However, instances in the private subnet cannot access the internet. What is the most likely cause?

A.The public subnet route table does not have a route to the internet gateway.

B.The security group assigned to the NAT gateway blocks outbound traffic.

C.The private subnet route table has a route to the internet gateway instead of the NAT gateway.

D.The NAT gateway does not have an Elastic IP associated.

AnswerA

NAT gateway needs internet gateway route in its subnet.

Why this answer

The NAT gateway is deployed in a public subnet, but for it to route traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, even though the private subnet's route table correctly points to the NAT gateway. This is the most likely cause because the NAT gateway itself needs internet access via the IGW to translate and forward traffic.

Exam trap

AWS often tests the misconception that a NAT gateway automatically has internet access simply because it is in a public subnet, but the critical missing piece is the explicit route to the internet gateway in that subnet's route table.

How to eliminate wrong answers

Option B is wrong because security groups are not assigned to NAT gateways; NAT gateways are controlled by network ACLs, not security groups, and security groups cannot be attached to NAT gateways. Option C is wrong because if the private subnet route table had a route to the internet gateway, instances would attempt direct internet access, which would fail since they are in a private subnet without a public IP, but the question states the route points to the NAT gateway, so this is not the issue. Option D is wrong because the question explicitly states the NAT gateway has an Elastic IP associated, so this cannot be the cause of the failure.

Practice this question →

141

MCQeasy

A company wants to connect an on-premises data center to AWS using a dedicated private connection that does not traverse the internet. Which AWS service should they use?

A.AWS Transit Gateway

B.AWS Site-to-Site VPN

C.AWS Direct Connect

D.VPC Peering

AnswerC

Dedicated private connection.

Why this answer

AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the internet entirely. This service uses industry-standard 802.1Q VLANs to create a private virtual interface (VIF) that connects directly to a virtual private gateway or AWS Transit Gateway, ensuring low latency, consistent bandwidth, and compliance with data sovereignty requirements.

Exam trap

AWS often tests the misconception that AWS Transit Gateway itself provides a dedicated private connection, but it is a routing service that requires an underlying physical or virtual link to extend to on-premises networks.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway is a network transit hub that interconnects VPCs and on-premises networks, but it is not a dedicated private connection service; it requires an underlying connection like Direct Connect or VPN to extend to on-premises. Option B is wrong because AWS Site-to-Site VPN creates an encrypted tunnel over the public internet, which does not meet the requirement of a dedicated private connection that does not traverse the internet. Option D is wrong because VPC Peering connects VPCs within AWS using the AWS global network, but it cannot connect an on-premises data center to AWS.

Practice this question →

142

Multi-Selectmedium

A company has a VPC with an internet gateway and a NAT Gateway. The private subnet route table has a default route to the NAT Gateway. The company wants to enable instances in the private subnet to access an S3 bucket in the same region without traversing the internet. Which TWO actions should the company take?

Select 2 answers

A.Remove the default route to the NAT Gateway from the private subnet route table.

B.Add a route to the S3 prefix list via the gateway endpoint in the private subnet route table.

C.Create a gateway VPC endpoint for S3.

D.Add a route to the S3 prefix list via the NAT Gateway in the private subnet route table.

E.Create an interface VPC endpoint for S3.

AnswersB, C

This enables private access.

Why this answer

Adding a route to the S3 prefix list via the gateway endpoint directs traffic destined for S3 through the VPC endpoint, keeping it within the AWS network. Option C is correct because a gateway VPC endpoint for S3 provides a private, scalable connection to S3 without requiring internet access or a NAT Gateway. Together, these actions allow private subnet instances to access S3 privately and efficiently.

Exam trap

The trap here is that candidates often confuse gateway endpoints with interface endpoints, incorrectly assuming S3 requires an interface endpoint, or they think the NAT Gateway must be removed entirely, when in fact the NAT Gateway should remain for other outbound traffic and only the S3-specific route needs to be added via the gateway endpoint.

Practice this question →

143

MCQeasy

A company wants to securely connect two VPCs in the same region. The VPCs must be able to communicate using private IP addresses, and connectivity should be highly available. Which solution meets these requirements?

A.Set up a VPN connection between the two VPCs using virtual private gateways.

B.Create an inter-region VPC peering connection.

C.Create a VPC peering connection between the two VPCs.

D.Use an AWS Transit Gateway to connect the two VPCs.

AnswerC

VPC peering provides low-latency, private connectivity between VPCs in the same region.

Why this answer

A VPC peering connection allows two VPCs in the same region to communicate using private IPv4 or IPv6 addresses as if they were on the same network, with no single point of failure. It is highly available by design since traffic flows directly between the VPCs using the AWS global network infrastructure, without any intermediate devices or bandwidth limits.

Exam trap

AWS often tests the misconception that a VPN connection is required for private IP communication between VPCs, but VPC peering provides direct, private, and highly available connectivity without the overhead of VPN tunnels.

How to eliminate wrong answers

Option A is wrong because a VPN connection between two VPCs using virtual private gateways introduces a single point of failure (the VPN tunnel endpoints) unless multiple tunnels are configured, and it adds complexity and latency compared to a native VPC peering solution. Option B is wrong because an inter-region VPC peering connection is used for VPCs in different AWS regions, not for VPCs in the same region, and the question specifies same-region connectivity. Option D is wrong because while an AWS Transit Gateway can connect two VPCs, it introduces an additional cost and a central hub that, although highly available, is unnecessary for a simple two-VPC scenario and adds complexity beyond the requirements.

Practice this question →

144

Multi-Selectmedium

A company wants to design a multi-region active-active architecture with Amazon Route 53 latency-based routing and failover using health checks. Which TWO configurations are necessary? (Choose two.)

Select 2 answers

A.Use geolocation routing to direct users to the nearest region

B.Assign a weight to each record for traffic distribution

C.Configure a latency alias record for each region's resource

D.Create a health check for each resource and associate it with the record

E.Set the failover record type to 'Active-Active'

AnswersC, D

Latency-based routing uses latency alias records.

Why this answer

Latency-based routing in Route 53 uses alias records to route traffic based on the lowest latency for the end user. Configuring a latency alias record for each regional resource (e.g., an Application Load Balancer) allows Route 53 to respond with the IP of the resource that provides the best latency. Option D is correct because health checks must be associated with each latency record to enable failover; if a resource fails its health check, Route 53 removes it from the pool of healthy endpoints, ensuring traffic is only routed to healthy regions.

Exam trap

The trap here is that candidates often confuse latency-based routing with geolocation routing, or incorrectly assume that a failover record type must be explicitly set to 'Active-Active', when in fact the active-active behavior is achieved by combining latency-based routing with health checks, not by a specific record type.

Practice this question →

145

MCQmedium

A company is designing a hybrid network architecture using AWS Direct Connect. They have a single Direct Connect connection with a private virtual interface (VIF) to a VPC in us-east-1. The on-premises network uses BGP to advertise a prefix (10.0.0.0/8) to AWS. The VPC has a CIDR of 10.1.0.0/16. The company wants to add a second VPC (10.2.0.0/16) in the same region and allow on-premises to communicate with both VPCs. They plan to use a Transit Gateway to connect the VPCs and the Direct Connect gateway. The Direct Connect gateway is associated with the Transit Gateway. The on-premises router is advertising 10.0.0.0/8. After configuration, the on-premises network can communicate with 10.1.0.0/16 but not with 10.2.0.0/16. The network engineer verifies that the Transit Gateway route table has routes for both VPC attachments and that the Direct Connect gateway is associated with the Transit Gateway. What is the MOST likely issue?

A.The Direct Connect gateway is not associated with the Transit Gateway route table that contains the 10.2.0.0/16 route

B.The Transit Gateway route table does not have a route for 10.2.0.0/16

C.The private virtual interface is not configured to support multiple VPCs

D.The on-premises router is not advertising the 10.2.0.0/16 prefix

AnswerA

If the Direct Connect gateway attachment is in a different route table, it won't propagate the VPC CIDR to on-premises.

Why this answer

When using a Direct Connect gateway with a Transit Gateway, the Direct Connect gateway propagates routes to the Transit Gateway. The Transit Gateway route table must have a route for the on-premises prefix (10.0.0.0/8) pointing to the Direct Connect gateway attachment. Also, the Transit Gateway must propagate the VPC CIDRs to the Direct Connect gateway so that on-premises can learn them.

The issue is likely that the 10.2.0.0/16 route is not being propagated to the Direct Connect gateway. This can happen if the Transit Gateway route table does not have the VPC attachment associated or if the route propagation is disabled for that VPC attachment. The engineer verified routes in the Transit Gateway route table, so the issue might be that the Direct Connect gateway is not receiving the route for 10.2.0.0/16.

Typically, the Transit Gateway automatically propagates routes from attachments to the Direct Connect gateway if the route table is associated. However, if the VPC attachment is not associated with the same route table as the Direct Connect gateway attachment, propagation may not happen. The most likely fix is to ensure that both VPC attachments and the Direct Connect gateway attachment are in the same Transit Gateway route table.

Practice this question →

146

Multi-Selectmedium

A company is designing a network for a multi-account AWS environment using AWS Organizations. They need to centralize network management and enable VPC connectivity across accounts. Which THREE services should they consider? (Choose THREE.)

Select 3 answers

A.AWS Resource Access Manager

B.AWS CloudFormation StackSets

C.VPC Peering

D.AWS Direct Connect

E.AWS Transit Gateway

AnswersA, B, E

Shares Transit Gateway and other resources across accounts.

Why this answer

AWS Resource Access Manager (RAM) is correct because it enables you to share centrally managed resources, such as Transit Gateways and VPC subnets, across multiple AWS accounts within an AWS Organization. This eliminates the need to create duplicate resources in each account and allows for centralized network management without requiring cross-account IAM roles or complex peering configurations.

Exam trap

The trap here is that candidates often select VPC Peering because it is a familiar, simple connectivity option, but they overlook that it lacks transitive routing and centralized management, making it unsuitable for a multi-account architecture where AWS Transit Gateway is the correct scalable solution.

Practice this question →

147

MCQmedium

A company is designing a hybrid network with AWS Direct Connect and AWS Site-to-Site VPN as backup. The primary Direct Connect connection uses a private VIF to a VPC. If the Direct Connect fails, traffic should automatically fail over to the VPN connection. What is the MOST reliable way to achieve this failover?

A.Use BGP on Direct Connect and static routes on the VPN connection, with a higher metric for the VPN static route.

B.Configure static routes on the customer gateway device with a lower metric for the Direct Connect interface.

C.Use BGP on both connections and prepend AS paths on the VPN routes to make them less preferred.

D.Use BGP on both connections and set a lower local preference on the Direct Connect routes.

AnswerC

Incorrect. Prepending AS paths on Direct Connect routes makes them less preferred, causing VPN to be used as primary, which contradicts the requirement that Direct Connect be primary.

Why this answer

Using BGP on both connections allows for dynamic routing and automatic failover. By prepending AS paths on the VPN routes, you make the VPN path less preferred, ensuring that Direct Connect is the primary path. If Direct Connect fails, the BGP session drops and the VPN routes become active.

This method provides symmetric failover in both directions and is recommended by AWS.

Exam trap

A common mistake is to prepend AS paths on the primary Direct Connect connection, which would make it less preferred and cause the VPN to become the primary path. Always prepend on the backup connection to deprioritize it.

How to eliminate wrong answers

Option A is wrong because mixing BGP on Direct Connect with static routes on the VPN creates an asymmetric routing control plane; static routes cannot dynamically react to Direct Connect failure, and a higher metric on the static route would actually make the VPN less preferred, not a backup. Option B is wrong because configuring static routes on the customer gateway device with a lower metric for Direct Connect does not provide dynamic failover; if the Direct Connect link fails, the static route remains in the routing table until manually removed or a connectivity check fails, leading to blackholing. Option D is wrong because setting a lower local preference on Direct Connect routes would make them less preferred than VPN routes, causing traffic to use the VPN as the primary path, which is the opposite of the desired design where Direct Connect is primary.

Practice this question →

148

MCQeasy

A company wants to connect an Amazon RDS for SQL Server database instance in a VPC to an on-premises application. The connection must be encrypted in transit and should traverse the AWS backbone network. Which solution meets these requirements?

A.Set up an AWS Client VPN endpoint and connect the on-premises application

B.Create a VPC endpoint for RDS and connect on-premises to the endpoint

C.Establish an AWS Site-to-Site VPN connection over AWS Direct Connect

D.Configure ClassicLink to connect the on-premises network to the VPC

AnswerC

A VPN over Direct Connect provides encrypted IPsec tunnels over the private AWS backbone.

Why this answer

An AWS Site-to-Site VPN connection over AWS Direct Connect provides an encrypted IPSec tunnel that traverses the AWS backbone network, ensuring encryption in transit and meeting the requirement to keep traffic off the public internet. Direct Connect provides a private physical connection to AWS, and the Site-to-Site VPN adds encryption over that link, which is ideal for connecting an on-premises application to an RDS for SQL Server instance in a VPC.

Exam trap

The trap here is that candidates may think Direct Connect alone provides encryption, but it does not; the question explicitly requires encryption in transit, so a Site-to-Site VPN must be layered over Direct Connect, not just Direct Connect or a VPN alone.

How to eliminate wrong answers

Option A is wrong because AWS Client VPN is a remote access VPN solution for individual clients (e.g., laptops) and does not provide a site-to-site connection for an on-premises application; it also does not inherently traverse the AWS backbone network. Option B is wrong because a VPC endpoint for RDS (Gateway or Interface endpoint) is used for private connectivity within AWS or from a VPC, but it cannot be directly connected from on-premises networks without additional VPN or Direct Connect; it does not provide a site-to-site encrypted tunnel. Option D is wrong because ClassicLink is a legacy feature for linking EC2-Classic instances to a VPC, not for connecting on-premises networks, and it does not support encryption in transit or traverse the AWS backbone.

Practice this question →

149

MCQeasy

A company needs to resolve DNS names within a VPC using a custom domain. Which AWS service should be used?

A.Elastic Load Balancing

B.Amazon CloudFront

C.Amazon Route 53 Resolver

D.AWS WAF

AnswerC

DNS resolution for VPC.

Why this answer

Amazon Route 53 Resolver provides recursive DNS resolution for VPCs and supports custom domain names via inbound and outbound endpoints. It integrates with on-premises DNS through conditional forwarding, enabling resolution of custom private domains within the VPC without exposing them to the internet.

Exam trap

AWS often tests the misconception that Route 53 public hosted zones or CloudFront can resolve custom VPC DNS names, but only Route 53 Resolver with private hosted zones or forwarding rules handles custom domain resolution within a VPC.

How to eliminate wrong answers

Option A is wrong because Elastic Load Balancing is a traffic distribution service for load balancing incoming requests, not a DNS resolution service; it does not resolve custom domain names within a VPC. Option B is wrong because Amazon CloudFront is a content delivery network (CDN) that caches and delivers content at edge locations, not a DNS resolver for VPC internal name resolution. Option D is wrong because AWS WAF is a web application firewall that protects against common web exploits, not a DNS service; it cannot resolve custom domain names.

Practice this question →

150

MCQhard

A company has a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to access the internet for software updates but must not be accessible from the internet. Which combination of resources meets these requirements with the least operational overhead?

A.A VPC endpoint for Amazon S3 in each private subnet

B.A NAT Gateway in each public subnet, with a route in the private route tables pointing to the NAT Gateway

C.A NAT instance in each public subnet, with a route in the private route tables pointing to the NAT instance

D.An Internet Gateway attached to the VPC with a route in the private route tables pointing to the Internet Gateway

AnswerB

NAT Gateway is managed and provides outbound internet access.

Why this answer

A NAT Gateway in each public subnet provides outbound-only internet access for instances in private subnets, with no inbound accessibility from the internet. This solution requires minimal operational overhead because NAT Gateways are fully managed by AWS, automatically handle failover across Availability Zones, and scale up to 45 Gbps without manual intervention. The private route table simply needs a default route (0.0.0.0/0) pointing to the NAT Gateway, which forwards traffic to the Internet Gateway attached to the VPC.

Exam trap

The ANS-C01 exam often tests the misconception that a VPC endpoint can replace a NAT Gateway for general internet access, but VPC endpoints only work for specific AWS services (like S3 or DynamoDB) and cannot reach arbitrary internet hosts for software updates.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint for Amazon S3 only provides private connectivity to S3, not general internet access for software updates from arbitrary internet hosts. Option C is wrong because a NAT instance is a self-managed EC2 instance that requires manual configuration, patching, and failover handling, resulting in higher operational overhead compared to a managed NAT Gateway. Option D is wrong because placing a route to the Internet Gateway directly in private subnets would make those instances publicly accessible from the internet, violating the requirement that they must not be accessible from the internet.

Practice this question →