CCNA Network Design Questions — Page 3 of 7

151

MCQeasy

A company needs to connect its on-premises data center to AWS using a dedicated, low-latency connection. Which AWS service should be used?

A.AWS Direct Connect

B.AWS Transit Gateway

C.AWS Site-to-Site VPN

D.VPC Peering

AnswerA

Direct Connect provides a dedicated, low-latency connection from on-premises to AWS.

Why this answer

AWS Direct Connect is the correct choice because it provides a dedicated, private, low-latency network connection from an on-premises data center directly to AWS, bypassing the public internet. This service uses industry-standard 802.1Q VLANs to create virtual interfaces, ensuring consistent performance and reduced latency for mission-critical workloads.

Exam trap

The trap here is that candidates often confuse AWS Site-to-Site VPN as a dedicated connection, but it is encrypted over the public internet and does not guarantee low latency or dedicated bandwidth, unlike Direct Connect.

How to eliminate wrong answers

Option B is wrong because AWS Transit Gateway is a network transit hub that interconnects VPCs and on-premises networks, but it does not itself provide a dedicated physical connection; it relies on underlying connectivity like Direct Connect or VPN. Option C is wrong because AWS Site-to-Site VPN uses the public internet with IPSec tunnels, introducing variable latency and potential bandwidth constraints, which does not meet the requirement for a dedicated, low-latency connection. Option D is wrong because VPC Peering connects only VPCs within AWS and cannot extend to an on-premises data center; it is not designed for hybrid connectivity.

Practice this question →

152

MCQeasy

A company has a VPC with a public subnet and a private subnet. The private subnet instances need to access an S3 bucket. Which configuration provides the most secure and efficient access without traversing the internet?

A.Establish a VPN connection to on-premises and route to S3 from there.

B.Use a NAT Gateway in the public subnet to route traffic to S3.

C.Create a VPC Gateway Endpoint for Amazon S3 and associate it with the private subnet route table.

D.Configure a proxy server in the public subnet.

AnswerC

Gateway Endpoint provides private, secure access to S3 without internet.

Why this answer

A VPC Gateway Endpoint for Amazon S3 allows instances in a private subnet to access S3 directly over the AWS network without traversing the internet, using a route table entry that targets the endpoint's prefix list. This provides the most secure and efficient access by keeping traffic within the AWS backbone, avoiding NAT Gateway costs and internet exposure.

Exam trap

AWS often tests the misconception that a NAT Gateway is required for private subnet internet access, but the trap here is that S3 can be accessed privately via a Gateway Endpoint without any internet gateway or NAT, making options like B and D seem plausible but incorrect.

How to eliminate wrong answers

Option A is wrong because routing traffic to S3 via a VPN connection to on-premises adds unnecessary latency, complexity, and cost, and still requires internet traversal from on-premises to S3 unless the on-premises network also has a direct connection like Direct Connect. Option B is wrong because a NAT Gateway in the public subnet forces traffic to traverse the internet to reach S3, which is less secure (exposes traffic to internet routing) and less efficient (adds NAT processing and potential bandwidth costs) compared to a Gateway Endpoint. Option D is wrong because a proxy server in the public subnet introduces a single point of failure, additional management overhead, and still requires traffic to go through the internet or NAT, defeating the purpose of secure and efficient private access.

Practice this question →

153

MCQeasy

A company has an application that requires fixed IP addresses for whitelisting by third-party partners. The application is hosted on an Application Load Balancer (ALB) in a VPC. Which solution provides static IP addresses for the ALB?

A.Place an AWS Global Accelerator in front of the ALB.

B.Use Amazon CloudFront with the ALB as origin.

C.Assign an Elastic IP to the ALB.

D.Replace the ALB with a Network Load Balancer (NLB).

AnswerA

Global Accelerator provides static IPs for ALB.

Why this answer

AWS Global Accelerator provides two static IP addresses that act as fixed entry points for traffic. By placing it in front of an Application Load Balancer (ALB), you can whitelist these static IPs with third-party partners while the ALB itself remains dynamic. Global Accelerator uses the AWS global network to route traffic to the ALB, preserving the ALB's native HTTP/HTTPS features.

Exam trap

The trap here is that candidates assume CloudFront provides static IPs (it does not — it uses a shared, dynamic IP range) or that an ALB can be assigned an Elastic IP (only NLBs support Elastic IP assignment), leading them to choose B or C instead of Global Accelerator.

How to eliminate wrong answers

Option B is wrong because Amazon CloudFront does not guarantee static IP addresses; its IP ranges change over time and are published as a list, not fixed for whitelisting. Option C is wrong because an Application Load Balancer (ALB) does not support Elastic IP assignment — Elastic IPs are only available for Network Load Balancers (NLBs) or EC2 instances. Option D is wrong because replacing the ALB with an NLB would lose HTTP/HTTPS-specific features (e.g., path-based routing, host-based routing, and WebSocket support) that the application likely requires.

Practice this question →

154

MCQmedium

A company has a VPC with a CIDR of 10.0.0.0/16. It has six subnets: three public (10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24) and three private (10.0.4.0/24, 10.0.5.0/24, 10.0.6.0/24). The company wants to launch an RDS instance in a private subnet. Which subnet should the RDS instance be placed in to maximize high availability and follow best practices?

A.Place the RDS instance in a public subnet and use security groups to restrict access.

B.Place the RDS instance in all three private subnets to maximize availability.

C.Place the RDS instance in two private subnets that are in different Availability Zones.

D.Place the RDS instance in a single private subnet with a large CIDR for future scaling.

AnswerC

This allows Multi-AZ deployment for high availability.

Why this answer

Amazon RDS Multi-AZ deployments require the RDS instance to be placed in at least two subnets that reside in different Availability Zones (AZs) within the same VPC. This configuration enables synchronous standby replication across AZs, providing automatic failover and high availability. The subnets must be private to ensure the database is not directly exposed to the internet, aligning with security best practices.

Exam trap

The trap here is that candidates often assume a single subnet is sufficient for high availability, but AWS RDS Multi-AZ explicitly requires subnets in at least two different Availability Zones to enable automatic failover and synchronous replication.

How to eliminate wrong answers

Option A is wrong because placing an RDS instance in a public subnet exposes it to the internet, violating the security best practice of keeping databases in private subnets; security groups alone do not eliminate the risk of misconfiguration or the inherent exposure of a public subnet. Option B is wrong because an RDS instance cannot be placed in all three private subnets simultaneously; RDS Multi-AZ supports only one primary and one standby in two different AZs, not three. Option D is wrong because placing the RDS instance in a single private subnet creates a single point of failure and does not provide high availability; RDS requires subnets in at least two AZs for Multi-AZ deployments.

Practice this question →

155

MCQhard

A company is migrating a legacy on-premises application to AWS. The application uses a large number of short-lived TCP connections and requires low latency. The network team is considering using either a Network Load Balancer (NLB) or a Gateway Load Balancer (GWLB). Which of the following is a key advantage of using NLB over GWLB for this use case?

A.NLB can forward traffic to third-party virtual appliances.

B.NLB can handle higher throughput than GWLB.

C.NLB preserves the client source IP, while GWLB does not by default.

D.NLB supports TLS termination, while GWLB does not.

AnswerC

NLB preserves source IP; GWLB uses GENEVE encapsulation and hides original source IP.

Why this answer

For an application using a large number of short-lived TCP connections requiring low latency, NLB is the optimal choice because it operates at Layer 4 and preserves the client source IP address by default, which is critical for applications that need to log or process the original client IP. GWLB, by design, uses GENEVE encapsulation (UDP port 6081) to tunnel traffic to backend appliances, which replaces the client source IP with the NLB's private IP unless explicit configuration (e.g., proxy protocol) is used. This makes NLB the better fit for preserving source IP without additional overhead.

Exam trap

The trap here is that candidates often confuse GWLB's transparent inline appliance support with NLB's source IP preservation, assuming that GWLB also preserves source IP by default, when in fact it uses GENEVE encapsulation that obscures the original client IP unless additional configuration is applied.

How to eliminate wrong answers

Option A is wrong because forwarding traffic to third-party virtual appliances is a key feature of Gateway Load Balancer (GWLB), not NLB; NLB targets EC2 instances, IP addresses, or Lambda functions, not transparent inline appliances. Option B is wrong because both NLB and GWLB can handle extremely high throughput (up to millions of packets per second), and neither has a documented throughput advantage over the other in AWS documentation; throughput is limited by the underlying instance types and scaling policies, not the load balancer type. Option D is wrong because NLB does not support TLS termination natively; it can offload TLS to targets using TLS listeners, but it does not terminate TLS itself—that is a feature of Application Load Balancer (ALB), not NLB.

Practice this question →

156

Multi-Selecthard

Which THREE of the following are valid considerations when designing a multi-Region active-active application using AWS Global Accelerator?

Select 3 answers

A.Global Accelerator supports sticky sessions (session affinity) based on client IP.

B.You can assign different weights to endpoints in different Regions to control traffic distribution.

C.Global Accelerator performs health checks on endpoints and routes traffic only to healthy endpoints.

D.Global Accelerator can preserve the client IP address when using Network Load Balancer as an endpoint.

E.Global Accelerator provides a set of static IP addresses that are unique to each Region.

AnswersB, C, D

Weights allow traffic splitting across endpoints.

Why this answer

AWS Global Accelerator allows you to assign different weights to endpoints in different Regions, enabling granular control over traffic distribution for active-active architectures. This is achieved through endpoint group weights, where you can adjust the proportion of traffic sent to each Regional endpoint group, supporting scenarios like gradual rollouts or load balancing across Regions.

Exam trap

AWS often tests the misconception that Global Accelerator provides per-Region unique static IPs, but the trap here is that the static IPs are global anycast addresses, not Regional, and candidates may confuse sticky sessions with Global Accelerator's lack of session affinity.

Practice this question →

157

MCQeasy

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They launch an EC2 instance in the private subnet that needs to download software updates from the internet. The company configures a NAT gateway in the public subnet and adds a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. The NAT gateway is assigned an Elastic IP address. However, the EC2 instance cannot reach the internet. The security group for the EC2 instance allows all outbound traffic. What is the MOST likely cause?

A.The NAT gateway is not associated with a security group that allows outbound traffic.

B.The NAT gateway's Elastic IP address is not properly allocated.

C.The public subnet's route table does not have a route to an internet gateway.

D.The private subnet's route table does not have a route to the NAT gateway.

AnswerC

Correct. The public subnet's route table must have a route to an internet gateway (IGW) for the NAT gateway to send traffic to the internet. Without this route, the NAT gateway is unable to forward packets from the private subnet to the internet.

Why this answer

The NAT gateway is in the public subnet, but the public subnet's route table must have a route to an internet gateway (0.0.0.0/0 -> IGW) for the NAT gateway to forward traffic to the internet. Without that route, the NAT gateway cannot communicate with the internet. Option A is incorrect because NAT gateways do not use security groups.

Option B is incorrect because the NAT gateway has an Elastic IP and is properly allocated; the issue is not with the Elastic IP. Option D is incorrect because the private subnet's route table already has a route to the NAT gateway (0.0.0.0/0 -> NAT), which is correctly configured.

Practice this question →

158

MCQeasy

A company has a VPC with public and private subnets. The private subnets need internet access for updates, but must not be directly reachable from the internet. Which AWS service should be used?

A.NAT gateway

B.Internet gateway

C.VPN connection

D.VPC endpoint

AnswerA

A NAT gateway enables outbound internet access for private subnets.

Why this answer

A NAT gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It resides in a public subnet with an Elastic IP and uses the internet gateway for outbound traffic, but it does not allow inbound traffic to reach the private instances directly.

Exam trap

AWS often tests the misconception that an internet gateway can be used for private subnets by adding a default route to it, but the trap here is that an internet gateway alone does not provide outbound-only access—it allows inbound traffic unless explicitly blocked by a network ACL, which still exposes the subnet to direct inbound connections.

How to eliminate wrong answers

Option B is wrong because an internet gateway allows bidirectional traffic between the VPC and the internet, which would make private subnets directly reachable from the internet if attached to their route table. Option C is wrong because a VPN connection provides encrypted connectivity to an on-premises network, not direct internet access for updates. Option D is wrong because a VPC endpoint provides private connectivity to AWS services (e.g., S3, DynamoDB) without traversing the internet, but it does not provide general internet access for updates.

Practice this question →

159

Multi-Selecthard

A company is designing a network architecture for a multi-account AWS environment using AWS Transit Gateway. They need to meet the following requirements: (1) Centralized inspection of traffic between VPCs using a firewall appliance. (2) Isolated development environments that cannot communicate with each other but can access the internet via a centralized NAT gateway. (3) Compliance with PCI DSS for production workloads, requiring encryption in transit between VPCs. Which TWO actions should they take?

Select 2 answers

A.Use VPC Peering for all inter-VPC communication

B.Create a dedicated inspection VPC with a firewall appliance and attach it to the Transit Gateway. Use Transit Gateway route tables to route traffic from all VPCs through the inspection VPC.

C.Use AWS Site-to-Site VPN between each VPC and a central VPN hub

D.Create separate Transit Gateway route tables for production and development environments. For development VPCs, add a static route for 0.0.0.0/0 pointing to a NAT Gateway in a shared services VPC.

E.Use AWS Client VPN to connect development VPCs to the production VPC

AnswersB, D

Provides centralized inspection.

Why this answer

It enables centralized traffic inspection by attaching a dedicated inspection VPC with a firewall appliance to the Transit Gateway and using separate route tables to force all inter-VPC traffic through that inspection VPC. This design meets the requirement for centralized inspection without requiring complex peering or VPN configurations.

Exam trap

The trap here is that candidates often assume VPC Peering or VPNs are simpler solutions for multi-VPC connectivity, but they fail to recognize that Transit Gateway is specifically designed for transitive routing and centralized inspection at scale, and that separate route tables are essential for isolating development environments while sharing a common NAT gateway.

Practice this question →

160

MCQeasy

A company has a VPC with two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). An EC2 instance in subnet A needs to communicate with an EC2 instance in subnet B. The instances are in the same VPC. What is the default behavior?

A.Communication is not allowed by default; a VPC peering connection is required

B.Communication is allowed only if they are in the same subnet

C.Communication is allowed only if a transit gateway is attached

D.Communication is allowed by default because they are in the same VPC

AnswerD

Instances in the same VPC can communicate by default.

Why this answer

By default, all instances within the same VPC can communicate with each other regardless of which subnet they reside in, as long as the VPC's main route table and network ACLs allow the traffic. The VPC's implicit router provides connectivity between all subnets, and the default security group allows inbound traffic from other members of the same security group. Therefore, an EC2 instance in subnet A can communicate with an instance in subnet B without any additional configuration.

Exam trap

The trap here is that candidates often confuse subnet isolation with VPC isolation, mistakenly thinking that different subnets require a peering or gateway to communicate, when in fact the VPC's internal routing handles it automatically.

How to eliminate wrong answers

Option A is wrong because VPC peering is used to connect different VPCs, not subnets within the same VPC; the VPC's internal router already provides connectivity. Option B is wrong because instances in different subnets within the same VPC can communicate by default; subnet boundaries do not block traffic unless explicitly configured with network ACLs or security groups. Option C is wrong because a transit gateway is used to connect multiple VPCs or on-premises networks, not for routing between subnets within a single VPC.

Practice this question →

161

Multi-Selecthard

A company has a VPC with CIDR 10.0.0.0/16 and two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). The company wants to add a new subnet for a third tier. Which of the following are valid subnet CIDRs that can be added? (Select TWO.)

Select 2 answers

A.10.0.1.128/25

B.10.0.3.0/24

C.10.0.0.0/24

D.10.1.0.0/16

E.10.0.2.64/26

AnswersB, C

This is within the VPC CIDR and does not overlap with existing subnets.

Why this answer

(10.0.3.0/24) is correct because it falls within the VPC CIDR 10.0.0.0/16 and does not overlap with the existing subnets (10.0.1.0/24 and 10.0.2.0/24). The /24 prefix length matches the existing subnet structure, and the third octet (3) is outside the range of the first two subnets, ensuring no IP address conflict.

Exam trap

AWS often tests the misconception that a subnet can be a subset of an existing subnet (e.g., 10.0.1.128/25 within 10.0.1.0/24), but AWS explicitly prohibits overlapping CIDR blocks within a VPC.

Practice this question →

162

MCQmedium

A company has a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to access the internet for software updates. The company must ensure that traffic from the private instances uses a single, predictable public IP address. What is the MOST cost-effective solution?

A.Attach an Internet Gateway to the VPC and update the private subnet route table with a default route to the Internet Gateway.

B.Create a Transit Gateway with a VPC attachment and route traffic through a central egress VPC.

C.Deploy a NAT Gateway in a public subnet in one Availability Zone, and route private subnet traffic to it.

D.Launch a NAT instance in a public subnet and configure source/destination check.

AnswerC

Correct: A single NAT Gateway provides outbound internet with a predictable IP, and is cost-effective.

Why this answer

A NAT Gateway in a public subnet provides outbound-only internet access for private instances, and it uses a single Elastic IP address, ensuring a predictable public IP. This is the most cost-effective managed solution, as NAT Gateways are highly available within an Availability Zone and require no manual instance management.

Exam trap

The trap here is that candidates may choose Option D (NAT instance) thinking it is cheaper, but they overlook the operational overhead and the fact that a NAT Gateway is fully managed and more cost-effective when factoring in maintenance and availability.

How to eliminate wrong answers

Option A is wrong because attaching an Internet Gateway to the VPC and adding a default route to it in private subnets would allow direct outbound traffic, but private instances lack public IPs, so traffic would be dropped; this configuration also bypasses NAT, exposing private instances to inbound traffic. Option B is wrong because a Transit Gateway with a central egress VPC introduces unnecessary complexity and cost (Transit Gateway hourly charges and cross-AZ data transfer) for a simple outbound-only requirement that can be met with a single NAT Gateway. Option D is wrong because a NAT instance requires manual management (e.g., patching, scaling, failover) and source/destination check must be disabled for it to forward traffic, but it is less cost-effective than a NAT Gateway when considering operational overhead and potential downtime.

Practice this question →

163

MCQhard

A company is migrating its on-premises data center to AWS. As part of the migration, they need to establish connectivity between their on-premises network (10.0.0.0/8) and multiple VPCs in a single region. They are using AWS Transit Gateway with a Direct Connect gateway. They have two Direct Connect connections, each with a private virtual interface (VIF) to the Direct Connect gateway. The on-premises routers are configured with BGP and are advertising 10.0.0.0/8. The Transit Gateway has three VPC attachments: VPC1 (10.1.0.0/16), VPC2 (10.2.0.0/16), and VPC3 (10.3.0.0/16). All VPC attachments are in the same Transit Gateway route table, which also includes the Direct Connect gateway attachment. Initially, all VPCs can communicate with on-premises. After a maintenance window, the network team adds a new on-premises subnet (10.4.0.0/16) and updates the BGP advertisement to include 10.4.0.0/16. However, after the change, instances in VPC3 can no longer reach on-premises resources in any subnet, while VPC1 and VPC2 can still communicate with all on-premises subnets including the new one. The network engineer checks the Transit Gateway route table and sees that the route for 10.0.0.0/8 is present, pointing to the Direct Connect gateway attachment. What is the MOST likely cause of the issue?

A.The VPC3 subnet route tables have a static route for 10.0.0.0/8 that points to a non-existent or unavailable target

B.The BGP advertisement for 10.4.0.0/16 exceeded the allowed prefix limit on the Direct Connect gateway

C.The Direct Connect gateway is not propagating routes to the Transit Gateway for VPC3

D.The Transit Gateway route table has a route for 10.4.0.0/16 that is blackholed

AnswerA

A more specific static route in the VPC route table can override the Transit Gateway route, causing blackhole.

Why this answer

The issue is specific to VPC3. Since the route table has a route for 10.0.0.0/8, all VPCs should be able to reach on-premises. However, if VPC3 has a more specific route that conflicts, it might cause issues.

But the most common cause is that the VPC3 route table (in the VPC itself) might have a local route or a VPN route that is more specific and overriding the Transit Gateway route. Alternatively, the Transit Gateway route table might have a specific route for VPC3 that is misconfigured. However, the description says the Transit Gateway route table has the correct route.

The issue could be that VPC3's subnet route tables have a route for the on-premises CIDR pointing to a different target (like a VPN connection) that is now inactive or incorrect. But the question says after adding the new subnet, VPC3 lost connectivity entirely. Perhaps the BGP update caused a route flap or a prefix limit was exceeded on the Direct Connect gateway, but that would affect all VPCs.

Since only VPC3 is affected, it's likely a VPC-specific issue. The most plausible is that the VPC3's route tables have a static route for the on-premises CIDR that was manually added and is now incorrect or conflicting. However, the best answer among the options is that the Transit Gateway route table has a blackhole route for 10.4.0.0/16, but that wouldn't affect all on-premises subnets.

Let's think: The Direct Connect gateway might have a prefix limit that was exceeded when adding 10.4.0.0/16, causing the BGP session to drop, but that would affect all VPCs. The most likely single-VPC issue is that VPC3's route tables have a route for the on-premises CIDR pointing to an incorrect attachment, like a peering connection or VPN that is not working. But the options given might include such a scenario.

I'll go with: The VPC3 route tables have a static route for 10.0.0.0/8 pointing to a network interface that no longer exists.

Practice this question →

164

MCQeasy

A company wants to allow their employees to securely access resources in a VPC from their home offices. Which AWS service should they use?

A.AWS Client VPN

B.AWS Direct Connect

C.AWS Site-to-Site VPN

D.Amazon CloudFront

AnswerA

Client VPN provides secure remote access for individual users.

Why this answer

AWS Client VPN is a managed, cloud-based VPN service that allows individual users to securely access AWS resources from remote locations, such as home offices, using a VPN client installed on their device. It supports OpenVPN-based connections and integrates with Active Directory for user authentication, making it ideal for remote employee access to a VPC without requiring dedicated hardware or complex site-to-site configurations.

Exam trap

AWS often tests the distinction between user-based VPN (Client VPN) and network-based VPN (Site-to-Site VPN), where candidates mistakenly choose Site-to-Site VPN for remote employees because they overlook the requirement for individual client software and user authentication.

How to eliminate wrong answers

Option B (AWS Direct Connect) is wrong because it provides a dedicated, private network connection from an on-premises data center to AWS, which is designed for high-bandwidth, consistent throughput and is not suitable for individual home office users due to high cost and physical installation requirements. Option C (AWS Site-to-Site VPN) is wrong because it creates a persistent VPN tunnel between an on-premises network (e.g., a corporate office with a router) and a VPC, requiring a customer gateway device and static routing, which is impractical for individual remote employees without a fixed network infrastructure. Option D (Amazon CloudFront) is wrong because it is a content delivery network (CDN) that caches and delivers static and dynamic content at edge locations, not a VPN service for secure network access to VPC resources.

Practice this question →

165

MCQhard

A company has a VPC with multiple subnets. The security team requires that all outbound traffic from the VPC to the internet must traverse a centralized inspection appliance for traffic inspection. Which architecture should be used?

A.Use VPC Peering between all VPCs

B.Configure a NAT Gateway in each Availability Zone

C.Use Transit Gateway with VPC attached and route traffic through a shared services VPC containing the inspection appliance

D.Use AWS Direct Connect to route traffic on-premises

AnswerC

Transit Gateway enables routing traffic through an inspection VPC.

Why this answer

A Transit Gateway with a shared services VPC architecture allows centralized inspection of all outbound internet traffic. By attaching the VPCs to a Transit Gateway and routing traffic through a shared services VPC that hosts the inspection appliance (e.g., a firewall or proxy), you can enforce security policies. The Transit Gateway acts as a hub, enabling transitive routing between VPCs while directing internet-bound traffic to the inspection appliance before it reaches an internet gateway or NAT gateway.

Exam trap

AWS often tests the misconception that VPC Peering or NAT Gateway can provide centralized inspection, but they lack the transitive routing and traffic forwarding capabilities required for a hub-and-spoke inspection model.

How to eliminate wrong answers

Option A is wrong because VPC Peering does not support transitive routing; traffic between peered VPCs cannot be routed through a centralized inspection appliance in another VPC without complex and unscalable full-mesh peering. Option B is wrong because a NAT Gateway only provides outbound internet connectivity with source NAT and does not support traffic inspection; it cannot forward traffic to an inspection appliance for deep packet inspection. Option D is wrong because AWS Direct Connect is used for private connectivity to on-premises networks, not for routing outbound internet traffic through an inspection appliance; it does not inherently provide internet access or traffic inspection capabilities.

Practice this question →

166

MCQeasy

A company wants to connect two VPCs in the same AWS region using a hub-and-spoke model. Which AWS service should be used to route traffic between the VPCs through a central inspection VPC?

A.AWS Direct Connect

B.AWS Transit Gateway

C.AWS VPN CloudHub

D.VPC Peering

AnswerB

Transit Gateway enables hub-and-spoke connectivity with centralized routing and inspection.

Why this answer

AWS Transit Gateway is the correct choice because it acts as a central hub that connects multiple VPCs and on-premises networks in a hub-and-spoke topology. It allows you to route traffic between VPCs through a central inspection VPC for security or compliance purposes, using route tables to control traffic flow without requiring individual peering connections.

Exam trap

The ANS-C01 exam often tests the misconception that VPC Peering can be used for hub-and-spoke topologies, but candidates must remember that VPC Peering does not support transitive routing, so traffic cannot pass through a central inspection VPC.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not a service for routing traffic between VPCs within the same region. Option C is wrong because AWS VPN CloudHub connects multiple VPN sites to a single VPN gateway, but it does not support VPC-to-VPC routing through a central inspection VPC. Option D is wrong because VPC Peering creates a direct, one-to-one connection between two VPCs and does not support transitive routing through a central VPC, making it unsuitable for a hub-and-spoke model with inspection.

Practice this question →

167

Multi-Selecthard

A company is designing a global network with multiple VPCs connected via AWS Transit Gateway. The company wants to route traffic between VPCs through a centralized inspection VPC that hosts firewalls. Which configurations are required? (Choose THREE.)

Select 3 answers

A.Configure a default route (0.0.0.0/0) in the Transit Gateway route table pointing to the inspection VPC attachment.

B.Create VPC endpoints for the inspection services.

C.Add static routes in the Transit Gateway route tables for VPC attachments.

D.Propagate VPC attachment routes to a dedicated route table.

E.Establish VPC peering connections between each VPC and the inspection VPC.

AnswersA, C, D

Directs all inter-VPC traffic to inspection VPC.

Why this answer

Configuring a default route (0.0.0.0/0) in the Transit Gateway route table pointing to the inspection VPC attachment forces all inter-VPC traffic that does not match a more specific route to be sent to the inspection VPC for firewall inspection. This is a common pattern for centralized inspection, where the inspection VPC acts as a next hop for all traffic between VPCs.

Exam trap

AWS often tests the misconception that VPC peering can be used for transitive routing or that VPC endpoints can replace Transit Gateway for inter-VPC traffic inspection, but neither supports the required centralized inspection pattern.

Practice this question →

168

MCQhard

Refer to the exhibit. An EC2 instance launched in subnet-1a is unable to access the internet. Which is the most likely cause?

A.The route table rtb-main does not have a default route to the internet gateway.

B.The VPC does not have DNS hostnames enabled.

C.Subnet-1a does not assign public IP addresses automatically.

D.Subnet-1a is not associated with any route table.

AnswerC

MapPublicIpOnLaunch is false, so instances lack public IPs.

Why this answer

If subnet-1a does not have the 'Auto-assign public IPv4 address' setting enabled, EC2 instances launched in that subnet will not receive a public IP address automatically. Without a public IP, the instance cannot communicate with the internet through an internet gateway, even if the route table has a default route (0.0.0.0/0) pointing to the internet gateway. The instance would need an Elastic IP or a public IP assigned at launch to enable internet access.

Exam trap

The ANS-C01 exam often tests the misconception that a missing default route is the only cause for internet access failure, but the trap here is that even with a correct route, the instance must have a public IP (via auto-assign or Elastic IP) for the internet gateway to forward traffic back to it.

How to eliminate wrong answers

Option A is wrong because the route table rtb-main could still have a default route to the internet gateway; the question does not indicate it is missing, and the issue is specifically about the subnet's public IP assignment. Option B is wrong because DNS hostnames are not required for internet access; they only affect DNS resolution for instances within the VPC, not the ability to route traffic to the internet. Option D is wrong because every subnet is implicitly associated with the main route table if no explicit association exists, so subnet-1a would still have a route table (rtb-main) and not be without one.

Practice this question →

169

MCQeasy

A company has a VPC with a CIDR block of 10.0.0.0/16. The company needs to peer with another VPC that has a CIDR block of 10.0.0.0/16. What should the network engineer do to enable connectivity between the two VPCs?

A.Use an AWS Transit Gateway with Network Address Translation (NAT) to resolve overlapping CIDRs.

B.Use an internet gateway to route traffic between the VPCs.

C.Create a VPC peering connection and add routes in both route tables.

D.Create a VPC peering connection and use a network address translation (NAT) device.

AnswerA

Transit Gateway can support overlapping CIDRs with NAT.

Why this answer

When two VPCs have overlapping CIDR blocks (both 10.0.0.0/16), a standard VPC peering connection cannot be established due to route table conflicts. An AWS Transit Gateway can be used with Network Address Translation (NAT) to translate the overlapping IP addresses, enabling connectivity between the VPCs by allowing traffic to be routed through the Transit Gateway with NAT applied to resolve the address conflict.

Exam trap

The trap here is that candidates assume VPC peering can always be established and then fixed with NAT, but AWS VPC peering explicitly requires non-overlapping CIDR blocks at the time of creation, making peering impossible regardless of later NAT configuration.

How to eliminate wrong answers

Option B is wrong because an internet gateway is designed to enable communication between a VPC and the internet, not between two VPCs; it cannot route traffic directly between VPCs. Option C is wrong because VPC peering requires non-overlapping CIDR blocks to add routes in both route tables; with identical 10.0.0.0/16 CIDRs, the routes would conflict, making peering impossible. Option D is wrong because a VPC peering connection cannot be created with overlapping CIDRs in the first place, so adding a NAT device after peering is not feasible; the peering request itself would fail due to the CIDR conflict.

Practice this question →

170

Multi-Selectmedium

A company is designing a hybrid network using AWS Direct Connect. They have a VPC with a CIDR of 10.0.0.0/16 and an on-premises network with CIDR 10.0.0.0/8. The company needs to ensure that traffic from the VPC to the on-premises network uses the Direct Connect connection and that traffic does not traverse the internet. Which TWO actions are required? (Choose TWO.)

Select 2 answers

A.Attach the VPC to an AWS Transit Gateway

B.Create a private virtual interface (VIF) on the Direct Connect connection

C.Configure static routes or BGP to advertise the on-premises CIDR to the VPC

D.Create a public virtual interface (VIF) on the Direct Connect connection

E.Create a Direct Connect Gateway to connect the VPC to the on-premises network

AnswersB, C

Private VIF allows connectivity to the VPC via the Virtual Private Gateway.

Why this answer

A private virtual interface (VIF) is required to connect your VPC to an on-premises network over Direct Connect. It allows traffic to traverse the Direct Connect connection privately, bypassing the internet. Without a private VIF, you cannot route traffic from the VPC to the on-premises network over the Direct Connect link.

Exam trap

The trap here is that candidates often confuse public VIFs with private VIFs, thinking a public VIF can be used for on-premises connectivity, or they assume a Direct Connect Gateway is always required for any Direct Connect setup, even for a single VPC.

Practice this question →

171

MCQhard

A company has a Direct Connect connection with two private virtual interfaces (VIFs) to two different VPCs in the same AWS Region. The company wants to use AWS Transit Gateway to simplify connectivity between these VPCs and their on-premises network. Which steps are required to integrate the existing Direct Connect connection with Transit Gateway?

A.Set up a VPN connection over the Direct Connect link and attach the VPN to the Transit Gateway.

B.Attach the existing private VIFs directly to the Transit Gateway.

C.Create a new private VIF on the Direct Connect connection and attach it to the Transit Gateway.

D.Create a Direct Connect gateway, associate the existing VIFs, and attach the Direct Connect gateway to the Transit Gateway.

AnswerD

This is the correct integration path.

Why this answer

AWS Direct Connect private VIFs cannot be attached directly to a Transit Gateway. Instead, you must create a Direct Connect Gateway, associate the existing private VIFs with it, and then attach the Direct Connect Gateway to the Transit Gateway. This architecture allows the Transit Gateway to route traffic between the on-premises network (via the Direct Connect connection) and the attached VPCs, while also enabling inter-VPC routing through the Transit Gateway.

Exam trap

The trap here is that candidates assume private VIFs can be attached directly to a Transit Gateway, similar to how they attach to VPCs, but AWS requires the intermediate Direct Connect Gateway to mediate between the Layer 2 VIF and the Layer 3 Transit Gateway routing domain.

How to eliminate wrong answers

Option A is wrong because setting up a VPN over Direct Connect adds unnecessary complexity and overhead; Transit Gateway natively supports Direct Connect Gateway integration without requiring a VPN. Option B is wrong because private VIFs cannot be attached directly to a Transit Gateway; they must be associated with a Direct Connect Gateway first. Option C is wrong because creating a new private VIF is unnecessary; the existing VIFs can be reused by associating them with a Direct Connect Gateway, and a single Direct Connect Gateway can handle multiple VIFs for the same Transit Gateway.

Practice this question →

172

MCQmedium

A company is designing a hybrid network architecture that connects an on-premises data center to AWS via AWS Direct Connect. The on-premises network uses BGP to advertise routes to AWS. The company wants to ensure that the on-premises network can reach all VPCs in the AWS account using a single Direct Connect virtual interface. Which solution should the architect use?

A.Create a Direct Connect gateway and associate all VPCs directly.

B.Create a transit gateway and a Direct Connect gateway. Attach the VPCs to the transit gateway and associate the transit gateway with the Direct Connect gateway.

C.Create VPC peering connections between all VPCs and the on-premises network.

D.Create a virtual private gateway and attach all VPCs to it.

AnswerB

This setup allows multiple VPCs to communicate over a single Direct Connect virtual interface.

Why this answer

A transit gateway acts as a central hub for VPC-to-VPC and on-premises connectivity, and when associated with a Direct Connect gateway via a transit virtual interface, it allows a single Direct Connect connection to reach multiple VPCs. The Direct Connect gateway terminates the BGP session from on-premises and forwards traffic to the transit gateway, which then routes to the attached VPCs. This design scales to many VPCs without requiring multiple virtual interfaces or complex peering.

Exam trap

The trap here is that candidates often assume a Direct Connect gateway can directly connect to multiple VPCs, but it requires a transit gateway to enable multi-VPC connectivity, as the Direct Connect gateway alone only supports a single VPC via a virtual private gateway.

How to eliminate wrong answers

Option A is wrong because a Direct Connect gateway can only be associated with a single virtual private gateway or transit gateway per association, not directly with multiple VPCs; it requires an intermediate gateway to route traffic to multiple VPCs. Option C is wrong because VPC peering does not support transitive routing and requires a full mesh of peering connections between all VPCs and the on-premises network, which is not feasible for a single Direct Connect virtual interface. Option D is wrong because a virtual private gateway can only be attached to a single VPC, so it cannot provide connectivity to all VPCs in the account via one Direct Connect virtual interface.

Practice this question →

173

Multi-Selecteasy

A company is designing a VPC architecture for a web application that must be highly available across multiple Availability Zones. Which TWO components should be deployed in at least two Availability Zones to meet this requirement?

Select 2 answers

A.Transit Gateway

B.Internet Gateway

C.NAT Gateway

D.Application Load Balancer (with subnets in multiple AZs)

E.VPN connection

AnswersC, D

NAT Gateway is deployed in a specific AZ; multiple AZs needed for HA.

Why this answer

A NAT Gateway is a regional resource that is deployed within a specific Availability Zone, but to achieve high availability across multiple AZs, you must deploy a NAT Gateway in each AZ used by your application. This ensures that if one AZ fails, instances in other AZs can still access the internet or other AWS services through their local NAT Gateway, preventing a single point of failure.

Exam trap

The trap here is that candidates often assume NAT Gateway is a regional service like Internet Gateway, but it is actually AZ-specific and requires explicit deployment in each AZ for high availability, while the Application Load Balancer requires subnets in multiple AZs to be considered highly available.

Practice this question →

174

Multi-Selecthard

Which TWO actions can be taken to reduce the attack surface of a VPC's public subnets? (Choose 2.)

Select 2 answers

A.Allow all inbound traffic from the internet to the public subnets

B.Place web servers in private subnets and use a load balancer in a public subnet

C.Use a single subnet for all application tiers

D.Use security groups to restrict inbound traffic to only necessary ports and IPs

E.Disable ICMP traffic on the network ACL

AnswersB, D

Reduces direct exposure of web servers.

Why this answer

Placing web servers in private subnets and using a load balancer in a public subnet reduces the attack surface by ensuring that the web servers have no direct internet-facing IP addresses. The load balancer acts as a single point of ingress, allowing security groups to tightly control traffic from the load balancer to the web servers, while the public subnet only exposes the load balancer's endpoints. This architecture follows AWS best practices for a multi-tier application, minimizing the number of resources directly accessible from the internet.

Exam trap

AWS often tests the misconception that disabling ICMP or using network ACLs alone is sufficient to reduce attack surface, when in fact the primary reduction comes from architectural changes like moving instances to private subnets and using a load balancer, combined with security group restrictions.

Practice this question →

175

MCQmedium

A company is deploying a web application in a VPC with public and private subnets. The web servers in public subnets must be protected from direct internet access, but they need to receive traffic from an Application Load Balancer (ALB). Which architecture should be used?

A.Internet-facing ALB in public subnets with web servers also in public subnets

B.Internal Network Load Balancer in private subnets with web servers

C.Internet-facing ALB in public subnets, and internal ALB in private subnets pointing to web servers

D.Amazon CloudFront with origin pointing to web servers in public subnets

AnswerC

This allows traffic to flow through the internet-facing ALB to the internal ALB, keeping web servers private.

Why this answer

It uses an internet-facing ALB in public subnets to receive traffic from the internet, then forwards it to an internal ALB in private subnets, which distributes traffic to web servers in private subnets. This ensures the web servers are not directly accessible from the internet, meeting the security requirement while still allowing traffic from the ALB. The internal ALB uses private IP addresses, keeping the web servers isolated from direct internet access.

Exam trap

The trap here is that candidates often assume an internet-facing ALB alone can protect servers in public subnets, but the key requirement is that servers must not be directly accessible from the internet, which necessitates placing them in private subnets and using an internal ALB for internal routing.

How to eliminate wrong answers

Option A is wrong because placing web servers in public subnets with an internet-facing ALB still allows direct internet access to the servers if security groups are misconfigured, and the requirement explicitly states servers must be protected from direct internet access. Option B is wrong because an internal Network Load Balancer cannot receive traffic from the internet; it only routes traffic within the VPC, so it cannot serve as the entry point for external users. Option D is wrong because Amazon CloudFront with an origin pointing to web servers in public subnets still exposes the servers directly to the internet (via the origin), and CloudFront does not inherently protect the servers from direct access unless additional measures like VPC origins or WAF are used, which are not specified.

Practice this question →

176

MCQmedium

A company wants to monitor network traffic in their VPC for troubleshooting and security analysis. They need to capture IP traffic information, including source/destination IPs, ports, and protocol, but not the packet payload. Which AWS service should be used?

A.Amazon CloudWatch Logs.

B.AWS Network Firewall.

C.VPC Flow Logs.

D.AWS Traffic Mirroring.

AnswerC

VPC Flow Logs capture metadata without payload.

Why this answer

VPC Flow Logs capture metadata about IP traffic in a VPC, including source/destination IPs, ports, protocol, and packet counts, but never the payload. This meets the requirement for troubleshooting and security analysis without the overhead or privacy concerns of full packet capture.

Exam trap

The trap here is that candidates confuse VPC Flow Logs (metadata only) with AWS Traffic Mirroring (full packet capture), assuming both provide payload data, but the question explicitly excludes payload capture.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch Logs is a service for storing, monitoring, and accessing log files from AWS resources, not for capturing network traffic metadata directly from the VPC. Option B is wrong because AWS Network Firewall is a managed firewall service that filters traffic based on rules, but it does not natively log flow-level metadata like source/destination IPs and ports without additional configuration. Option D is wrong because AWS Traffic Mirroring copies entire packets (including payload) from network interfaces for deep packet inspection, which exceeds the requirement to capture only metadata and not payload.

Practice this question →

177

MCQmedium

A company has a VPC with an application load balancer (ALB) in public subnets and web servers in private subnets. The web servers must be accessible only from the ALB. What is the most secure and efficient configuration?

A.Configure the web server security group to allow inbound HTTP from 0.0.0.0/0.

B.Configure the web server security group to allow inbound HTTP from the ALB's security group.

C.Configure the web server security group to allow inbound HTTP from the ALB's private IP addresses.

D.Configure the web server security group to allow inbound HTTP from the VPC CIDR.

AnswerB

Correct: Only ALB traffic is allowed.

Why this answer

Referencing the ALB's security group in the web server security group rule allows traffic only from the ALB, regardless of its IP addresses. This is the most secure and efficient configuration as it leverages AWS security group referencing, which automatically scales with the ALB's elastic network interfaces and avoids managing IP changes.

Exam trap

The ANS-C01 exam often tests the misconception that using the ALB's private IP addresses is more secure than using security group references, but the trap is that IP-based rules are static and break when the ALB scales, whereas security group references are dynamic and the recommended best practice.

How to eliminate wrong answers

Option A is wrong because allowing inbound HTTP from 0.0.0.0/0 would permit traffic from any source on the internet, bypassing the ALB and exposing the web servers directly, violating the requirement of access only from the ALB. Option C is wrong because the ALB's private IP addresses can change due to scaling or replacement, making this configuration brittle and requiring manual updates; it also does not leverage the dynamic security group referencing feature. Option D is wrong because allowing inbound HTTP from the VPC CIDR would permit traffic from any resource within the VPC (e.g., other instances, NAT gateways) rather than exclusively from the ALB, violating the access restriction and potentially allowing unauthorized internal access.

Practice this question →

178

MCQeasy

A company has a VPC with public and private subnets. They launch an Amazon RDS for MySQL DB instance in a private subnet. The DB instance needs to be accessible from an on-premises application that connects via an AWS Site-to-Site VPN. What is the MOST secure way to allow the on-premises application to connect to the DB instance?

A.Assign a public IP address to the DB instance and restrict access using a security group.

B.Place the DB instance in a private subnet and use a NAT gateway to allow inbound traffic.

C.Place the DB instance in a public subnet and configure a network ACL to allow traffic from the on-premises CIDR.

D.Place the DB instance in a private subnet and configure a security group to allow inbound traffic from the on-premises CIDR.

AnswerD

Private subnet with security group provides granular, stateful firewall control without internet exposure.

Why this answer

Placing the RDS DB instance in a private subnet ensures it has no public IP address, and configuring a security group to allow inbound traffic from the on-premises CIDR over the Site-to-Site VPN provides a secure, direct connection without exposing the database to the internet. Security groups act as a stateful firewall at the instance level, allowing only specified traffic from the on-premises network through the VPN tunnel.

Exam trap

The trap here is that candidates often confuse the directionality of NAT gateways (outbound only) or assume that placing a database in a public subnet with a network ACL is sufficient, overlooking the inherent security advantage of keeping the instance in a private subnet without public exposure.

How to eliminate wrong answers

Option A is wrong because assigning a public IP address to the DB instance exposes it to the internet, increasing the attack surface, and security groups alone cannot prevent internet-based threats if the instance is publicly reachable. Option B is wrong because a NAT gateway is used for outbound traffic from private subnets to the internet, not for inbound traffic; it cannot initiate inbound connections from on-premises to the DB instance. Option C is wrong because placing the DB instance in a public subnet exposes it to the internet, and network ACLs are stateless, requiring explicit inbound and outbound rules, which is less secure and more complex than using security groups in a private subnet with VPN connectivity.

Practice this question →

179

MCQhard

A company is designing a global application that will use Amazon CloudFront to serve content from an Application Load Balancer (ALB) in us-east-1. They want to restrict access to the ALB so that it only accepts traffic from CloudFront. Additionally, they want to ensure that if someone bypasses CloudFront and directly accesses the ALB, the request is denied. Which solution should they implement?

A.Use CloudFront Origin Access Control (OAC) to restrict access to the ALB.

B.Configure the ALB security group to allow inbound traffic only from the CloudFront IP address ranges published in the AWS IP address ranges JSON file.

C.Use AWS WAF on the ALB with a rule that allows traffic only from CloudFront IP ranges.

D.Configure CloudFront to add a custom HTTP header (e.g., X-Origin-Verify) to requests forwarded to the ALB. Configure the ALB to only forward requests that contain that specific header to the target group.

AnswerD

This ensures that only requests from CloudFront with the correct header are accepted, preventing direct access.

Why this answer

It uses a custom HTTP header (e.g., X-Origin-Verify) that CloudFront adds to requests forwarded to the ALB, and the ALB is configured to only forward requests containing that specific header to the target group. This ensures that any request not originating from CloudFront (i.e., direct access to the ALB) lacks the header and is denied, providing a secure and scalable method to restrict access without relying on static IP lists.

Exam trap

AWS often tests the misconception that CloudFront Origin Access Control (OAC) or IP-based restrictions (security groups or WAF) are sufficient for ALB origins, but the trap is that OAC only works with S3 and IP lists are dynamic and spoofable, making the custom header method the only reliable solution for non-S3 origins.

How to eliminate wrong answers

Option A is wrong because CloudFront Origin Access Control (OAC) is designed to restrict access to Amazon S3 origins, not Application Load Balancers; it uses signed requests with AWS Signature Version 4, which ALBs do not support. Option B is wrong because the CloudFront IP address ranges published in the AWS IP address ranges JSON file are not static and can change frequently, requiring constant updates to the ALB security group, and this approach does not prevent bypass if an attacker spoofs a CloudFront IP. Option C is wrong because using AWS WAF on the ALB with a rule that allows traffic only from CloudFront IP ranges suffers from the same IP volatility and spoofing risks as Option B, and WAF rules based on IP sets are not a reliable or recommended method for origin access restriction in this scenario.

Practice this question →

180

MCQhard

A company has a global application deployed across multiple AWS Regions. They use an Amazon Route 53 latency-based routing policy to direct users to the closest region. Recently, users in Asia are experiencing high latency even though traffic is being directed to the nearest region. The network team reviews the latency measurements and notices that the Route 53 latency values are based on the region where the resources are hosted, but the actual application performance is poor. What is the most likely cause?

A.The Route 53 health checks are failing, causing traffic to be routed to a different region.

B.The company has not enabled DNSSEC, causing additional DNS resolution time.

C.The application in the Asian region is overloaded, causing increased response times.

D.The Route 53 latency routing policy is not using anycast, causing suboptimal routing.

AnswerC

Latency routing only optimizes network path; application slowdown still causes high latency.

Why this answer

Route 53 latency-based routing measures the network latency between the user and the AWS region where the resources are hosted, not the application response time. If the application in the Asian region is overloaded, it will respond slowly, causing high latency for users even though traffic is correctly routed to the nearest region. Option A is incorrect because health checks would cause failover to another region, which would not explain high latency when traffic still goes to Asia.

Option B is incorrect because DNSSEC adds minimal overhead and does not significantly impact latency. Option D is incorrect because anycast is used by Route 53 for DNS query resolution, not for the routing policy itself; the latency policy already directs users to the region with the lowest network latency.

Practice this question →

181

MCQmedium

A network engineer is troubleshooting connectivity between a VPC (10.0.0.0/16) and a peered VPC (10.1.0.0/16). The route table shown is associated with subnet-aaa. An EC2 instance in subnet-aaa cannot reach an instance in the peered VPC. What is the issue?

A.The route to the peered VPC's CIDR is missing

B.The route table does not have a route to an Internet Gateway

C.The route table is not associated with the correct subnet

D.The VPC peering connection is not in the 'active' state

AnswerD

If the peering connection is pending or rejected, traffic will not flow even though the route exists.

Why this answer

A VPC peering connection must be in the 'active' state for traffic to flow between the VPCs. If the peering connection is in any other state (e.g., 'pending-acceptance', 'expired', 'failed', or 'deleted'), the route to the peered VPC's CIDR will be considered a black hole, and the EC2 instance in subnet-aaa will be unable to reach the instance in the peered VPC. The route table shown includes a route for 10.1.0.0/16 pointing to the peering connection, but the connection's state must be verified as 'active' for the route to be effective.

Exam trap

AWS often tests the misconception that simply adding a route to the peered VPC's CIDR in the route table is sufficient for connectivity, but the trap here is that the VPC peering connection must be in the 'active' state; otherwise, the route is a black hole and traffic will not flow.

How to eliminate wrong answers

Option A is wrong because the route table shown includes a route for 10.1.0.0/16 with the peering connection as the target, so the route to the peered VPC's CIDR is present, not missing. Option B is wrong because an Internet Gateway route is irrelevant for VPC peering traffic; the EC2 instance is trying to reach a private IP in the peered VPC, not the internet, and the route table does not need an IGW route for this communication. Option C is wrong because the question states the route table is associated with subnet-aaa, and the EC2 instance is in subnet-aaa, so the association is correct; the issue lies elsewhere.

Practice this question →

182

Multi-Selecthard

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The company wants to centralize internet egress for all VPCs through a single VPC that has a NAT Gateway and an internet gateway. Which TWO configurations are required to achieve this?

Select 2 answers

A.In the egress VPC, add a route for 0.0.0.0/0 to the Transit Gateway.

B.Create a VPN connection between each VPC and the Transit Gateway.

C.In the egress VPC, add a route for 0.0.0.0/0 to the internet gateway in the route table of the subnet containing the NAT Gateway.

D.In each non-egress VPC, add a route for 0.0.0.0/0 to the Transit Gateway.

E.In each non-egress VPC, delete the local route.

AnswersC, D

This allows the NAT Gateway to reach the internet via the internet gateway.

Why this answer

The egress VPC must route traffic from the NAT Gateway to the internet gateway for internet-bound traffic. The NAT Gateway resides in a public subnet with a route table that directs 0.0.0.0/0 to the internet gateway, enabling outbound connectivity. This allows the NAT Gateway to translate private IPs from other VPCs and forward traffic to the internet.

Exam trap

The trap here is that candidates often think the egress VPC needs a route to the Transit Gateway for 0.0.0.0/0, but this would create a loop; instead, the egress VPC must route directly to the internet gateway, while non-egress VPCs point to the Transit Gateway.

Practice this question →

183

Multi-Selecthard

A company has a VPC with a public subnet and a private subnet. The private subnet hosts Amazon RDS instances. The security team wants to ensure that the RDS instances are not accessible from the internet. Which TWO actions should be taken?

Select 2 answers

A.Disable the 'Publicly accessible' option for the RDS instances.

B.Create a network ACL that denies all inbound traffic from 0.0.0.0/0.

C.Remove the route to an internet gateway from the private subnet's route table.

D.Ensure that the RDS instances are launched in a private subnet without a public IP address.

E.Configure the security group for the RDS instances to deny all inbound traffic.

AnswersC, D

Without a route to an internet gateway, traffic cannot reach the internet.

Why this answer

Options C and D are the correct actions. Removing the route to an internet gateway from the private subnet's route table ensures that the subnet cannot send traffic to or receive traffic from the internet. Launching RDS instances in a private subnet without a public IP address ensures they do not have direct internet connectivity.

Option A is not effective because disabling 'Publicly accessible' only prevents RDS from being assigned a public IP address, but if the instance is in a public subnet with a public route, it could still be accessible. Option B is incorrect because a network ACL that denies all inbound traffic from 0.0.0.0/0 would block all inbound traffic, including necessary traffic from within the VPC, and is not a recommended approach. Option E is wrong because configuring a security group to deny all inbound traffic would block all inbound connections, which would prevent legitimate access to RDS from authorized resources.

Practice this question →

184

Multi-Selectmedium

A company is designing a network for a three-tier web application that must be highly available across multiple Availability Zones. The application uses an Application Load Balancer (ALB) for the web tier, EC2 instances for the application tier, and an Amazon RDS Multi-AZ database for the database tier. Which TWO design choices improve availability and fault tolerance?

Select 2 answers

A.Launch all EC2 instances in a single Availability Zone to reduce network latency.

B.Configure Amazon RDS Multi-AZ with a standby instance in a different Availability Zone.

C.Use a single NAT gateway in one Availability Zone for all outbound traffic.

D.Deploy the ALB across at least two Availability Zones.

E.Use VPC Gateway Endpoints for S3 to avoid NAT gateway costs.

AnswersB, D

Provides automatic failover.

Why this answer

Amazon RDS Multi-AZ automatically provisions and maintains a synchronous standby replica in a different Availability Zone, providing automatic failover in the event of an AZ failure or database instance failure. This ensures the database tier remains available without manual intervention, directly improving fault tolerance for the three-tier application.

Exam trap

AWS often tests the misconception that a single NAT gateway is sufficient for high availability, but the trap here is that a single NAT gateway is a single point of failure unless paired with a second NAT gateway in another AZ and route tables that direct traffic to the healthy gateway.

Practice this question →

185

Multi-Selecthard

A company has a VPC with CIDR 10.0.0.0/16. They have two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). An EC2 instance in subnet A needs to communicate with an RDS database in subnet B. Both subnets have network ACLs that allow all inbound and outbound traffic. However, the instance cannot connect to the database. Which TWO configuration changes could solve this issue? (Choose TWO.)

Select 2 answers

A.Attach an Internet Gateway to the VPC.

B.Ensure that the route tables associated with both subnets have a local route for the VPC CIDR.

C.Create a VPC peering connection between the subnets.

D.Modify the security group for the RDS database to allow inbound traffic from the EC2 instance's security group on port 3306.

E.Add a NAT Gateway in a public subnet and route traffic through it.

AnswersB, D

Local route is needed for intra-VPC communication.

Why this answer

The local route for the VPC CIDR (10.0.0.0/16) is automatically added to the main route table, but if custom route tables are associated with subnets A and B, they must explicitly include this local route to enable routing between subnets within the same VPC. Without it, traffic from the EC2 instance in subnet A cannot reach the RDS database in subnet B, even if network ACLs allow all traffic.

Exam trap

AWS often tests the misconception that network ACLs alone control all traffic flow, but candidates forget that security groups must also allow inbound traffic, and that route tables must have a local route for intra-VPC communication.

Practice this question →

186

MCQhard

A network engineer is troubleshooting a VPN connection between an on-premises network (172.16.0.0/16) and an AWS VPC (10.0.0.0/16). The VPN status is 'available' but traffic is not passing. The engineer runs the command shown in the exhibit. What is the most likely cause of the issue?

A.The VPN tunnels are not in 'UP' state.

B.The VPC route table does not have a route for 172.16.0.0/16 pointing to the virtual private gateway.

C.The tunnel inside CIDRs overlap with the VPC CIDR.

D.The BGP session is not established.

AnswerB

Without this route, VPC traffic to on-premises is dropped.

Why this answer

The VPN status is 'available', which indicates that the VPN tunnels are established and the BGP sessions (if configured) are up. However, traffic still fails because the VPC route table lacks a route for the on-premises CIDR (172.16.0.0/16) pointing to the virtual private gateway (VGW). Without this route, the VPC does not know to send traffic destined for the on-premises network through the VPN connection, even though the tunnels themselves are operational.

Exam trap

The trap here is that candidates see 'available' status and assume all components are working, but they overlook the critical requirement of a route in the VPC route table pointing to the virtual private gateway for the on-premises CIDR.

How to eliminate wrong answers

Option A is wrong because the VPN status 'available' means the tunnels are in 'UP' state; if they were not, the status would be 'down' or 'degraded'. Option C is wrong because tunnel inside CIDRs (typically link-local addresses like 169.254.x.x) are used for BGP peering and do not overlap with the VPC CIDR (10.0.0.0/16); overlapping inside CIDRs would cause a different error, such as BGP session failure, not a traffic pass issue with 'available' status. Option D is wrong because the VPN status 'available' indicates that the BGP session is established; if BGP were not established, the status would show 'down' or 'negotiation'.

Practice this question →

187

MCQeasy

A company needs to connect its on-premises data center to a VPC in AWS using a dedicated, private, and high-bandwidth connection. Which AWS service should be used?

A.AWS Client VPN

B.VPC Peering

C.AWS Site-to-Site VPN

D.AWS Direct Connect

AnswerD

Dedicated private connection.

Why this answer

AWS Direct Connect is the correct choice because it provides a dedicated, private, high-bandwidth network connection from an on-premises data center directly to AWS, bypassing the public internet. This meets the requirements for a private, low-latency, and consistent network path, unlike VPN-based solutions that traverse the internet.

Exam trap

The trap here is that candidates often confuse AWS Site-to-Site VPN with a dedicated connection, overlooking that it still relies on the public internet and lacks the private, consistent bandwidth guarantees of Direct Connect.

How to eliminate wrong answers

Option A is wrong because AWS Client VPN is a managed remote access VPN service for individual clients (e.g., laptops) to connect to AWS or on-premises networks, not a dedicated high-bandwidth connection between a data center and a VPC. Option B is wrong because VPC Peering connects two VPCs within AWS, not an on-premises data center to a VPC, and it does not provide a dedicated physical connection. Option C is wrong because AWS Site-to-Site VPN creates an encrypted tunnel over the public internet, which does not offer the dedicated, private, or consistent high-bandwidth characteristics required; it is subject to internet variability and latency.

Practice this question →

188

MCQhard

An IAM policy attached to a user allows creating and deleting VPCs and subnets only in us-east-1. The user attempts to create a VPC in eu-west-1. What will happen?

A.The API call will be denied with an authorization error.

B.The VPC will be created but the user will receive a warning.

C.The user can create the VPC because the condition is not applicable to VPC creation.

D.The VPC will be created successfully because the policy allows ec2:CreateVpc.

AnswerA

The condition fails, so IAM denies the action.

Why this answer

The IAM policy explicitly restricts the ec2:CreateVpc action to us-east-1 using a Condition element with ec2:Region. When the user attempts to create a VPC in eu-west-1, the condition is not satisfied, so the request is denied with an authorization error (HTTP 403). IAM policies are evaluated before any API call is executed, and if the condition fails, the action is blocked regardless of the resource-level permissions.

Exam trap

The trap here is that candidates assume a policy that allows ec2:CreateVpc without a resource restriction will permit VPC creation in any region, but they overlook the Condition element that scopes the permission to a specific region, causing them to pick Option D.

How to eliminate wrong answers

Option B is wrong because AWS IAM does not issue warnings; it either allows or denies the API call based on policy evaluation, and a denied request results in an explicit error. Option C is wrong because the condition is directly applicable to VPC creation—the ec2:Region condition key is evaluated for the ec2:CreateVpc action, and if the region does not match, the policy denies the request. Option D is wrong because the policy does not allow ec2:CreateVpc globally; it only allows the action when the condition (us-east-1) is met, so the request to eu-west-1 is denied.

Practice this question →

189

MCQmedium

A company is designing a network for a multi-tier application. The web tier must be accessible from the internet, the application tier must be accessible only from the web tier, and the database tier must be accessible only from the application tier. Which architecture meets these requirements?

A.Place each tier in a separate subnet and use network ACLs to allow traffic between tiers

B.Place each tier in a separate subnet and use security groups to allow traffic between tiers

C.Place all tiers in the same subnet and use security groups to control traffic

D.Place all tiers in a public subnet and use a NAT gateway for the application and database tiers

AnswerB

This provides isolation and granular control using security groups.

Why this answer

Security groups act as a stateful virtual firewall at the instance level, allowing you to specify inbound and outbound rules based on source/destination security group IDs. By placing each tier in a separate subnet and referencing the web tier's security group as the source for the application tier's inbound rule, and the application tier's security group as the source for the database tier's inbound rule, you achieve the required least-privilege access without exposing the application or database tiers to the internet.

Exam trap

The ANS-C01 exam often tests the distinction between stateful security groups and stateless network ACLs, and the trap here is that candidates assume network ACLs are the correct choice for subnet-level isolation, overlooking that security groups provide more granular, stateful control between tiers.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and require separate inbound and outbound rules for return traffic, making them more complex to manage and less precise for instance-level control compared to security groups. Option C is wrong because placing all tiers in the same subnet would allow lateral traffic between instances unless explicitly blocked, and security groups alone cannot prevent all inter-tier traffic if they are not correctly referenced; more importantly, the web tier would be in the same subnet as the database, violating the isolation requirement. Option D is wrong because placing all tiers in a public subnet exposes the application and database tiers to the internet directly, and a NAT gateway is used for outbound internet access from private subnets, not for controlling inbound access between tiers.

Practice this question →

190

MCQhard

A company is deploying a VPC with a public and private subnet in each of three Availability Zones. They need to provide internet access to instances in the private subnets while ensuring that all outbound traffic is logged and that traffic to a particular on-premises CIDR (10.0.0.0/8) is routed via an AWS Direct Connect Virtual Private Gateway. The company has a VPN connection as a backup. Which design should they use?

A.Create a centralized egress VPC with NAT Gateways in each AZ. Peer the application VPCs to the egress VPC. Configure route tables in the application VPCs to send 0.0.0.0/0 to the egress VPC and 10.0.0.0/8 to the Direct Connect Virtual Private Gateway.

B.Place a NAT Gateway in each AZ in the application VPC. Configure route tables to send 0.0.0.0/0 to the NAT Gateway. Use a VPN connection for on-premises traffic.

C.Use a Transit Gateway to connect all VPCs and on-premises. Attach a NAT Gateway in one AZ to the Transit Gateway. Configure route tables to send 0.0.0.0/0 to the NAT Gateway and 10.0.0.0/8 to the Direct Connect Virtual Private Gateway.

D.Create a NAT instance in each private subnet and configure each instance's route table to send 0.0.0.0/0 to the NAT instance. For on-premises traffic, use a VPC peering connection to an on-premises network.

AnswerA

This design centralizes egress traffic, uses managed NAT Gateways, and allows logging. Route tables direct on-premises traffic through DX.

Why this answer

It uses a centralized egress VPC with NAT Gateways in each AZ to provide internet access to private subnets while logging all outbound traffic. By peering the application VPCs to the egress VPC, the route tables can direct 0.0.0.0/0 traffic to the egress VPC for NAT, and 10.0.0.0/8 traffic to the Direct Connect Virtual Private Gateway, ensuring on-premises traffic uses the dedicated connection with VPN backup. This design meets all requirements: internet access, logging, and specific routing for on-premises CIDR.

Exam trap

The trap here is that candidates often assume NAT Gateways must be placed in the same VPC as the private subnets, overlooking the centralized egress VPC pattern that enables logging and centralized control, and they may incorrectly think a Transit Gateway can directly attach a NAT Gateway.

How to eliminate wrong answers

Option B is wrong because it places NAT Gateways in the application VPC, which does not provide centralized logging of all outbound traffic, and it uses a VPN connection for on-premises traffic instead of routing 10.0.0.0/8 via Direct Connect as required. Option C is wrong because attaching a NAT Gateway to a Transit Gateway is not a supported configuration; NAT Gateways cannot be attached to Transit Gateways, and this design would not log all outbound traffic. Option D is wrong because it uses NAT instances instead of NAT Gateways, which are less reliable and do not provide the same level of logging, and it uses VPC peering for on-premises traffic, which is not a valid connection method for on-premises networks (Direct Connect or VPN are required).

Practice this question →

191

MCQhard

A company has created a VPC Interface Endpoint for Amazon ECR (Docker registry API) as shown in the exhibit. However, an EC2 instance in the same VPC is unable to authenticate with the ECR registry using the private DNS name. What is the most likely cause?

A.Private DNS is not enabled for the endpoint

B.The endpoint service name is incorrect; it should be com.amazonaws.us-east-1.ecr.api

C.The endpoint is not in the 'available' state

D.The endpoint type should be Gateway, not Interface

AnswerA

When PrivateDnsEnabled is false, the private DNS name for the service is not automatically resolved to the endpoint's IPs, causing authentication failures.

Why this answer

The most likely cause is that Private DNS is not enabled for the VPC Interface Endpoint. When Private DNS is enabled, the endpoint automatically associates a Route 53 private hosted zone with the VPC, allowing the default private DNS name (e.g., *.dkr.ecr.us-east-1.amazonaws.com) to resolve to the endpoint's elastic network interface IP addresses. Without this, the EC2 instance will resolve the private DNS name to the public IP of the ECR service, bypassing the endpoint and failing authentication due to network path issues.

Exam trap

The trap here is that candidates often confuse the endpoint service name for ECR (dkr vs. api) or assume a Gateway endpoint can be used for ECR, but the core issue is the Private DNS toggle, which is a subtle but critical setting for Interface endpoints.

How to eliminate wrong answers

Option B is wrong because the endpoint service name for ECR Docker registry API is com.amazonaws.us-east-1.ecr.dkr, not com.amazonaws.us-east-1.ecr.api (the latter is for the ECR API, not the registry). Option C is wrong because if the endpoint were not in the 'available' state, it would not be functional at all, but the question states the endpoint is created as shown, implying it is available; the issue is DNS resolution, not endpoint state. Option D is wrong because ECR requires an Interface endpoint (powered by AWS PrivateLink) for private connectivity to the Docker registry API; a Gateway endpoint is only used for services like S3 and DynamoDB, not for ECR.

Practice this question →

192

MCQmedium

A company is designing a network architecture for a two-tier web application. The web tier runs on EC2 instances behind an Application Load Balancer (ALB) in public subnets. The application tier runs on EC2 instances in private subnets. The application tier needs to access an Amazon RDS for PostgreSQL database in the same private subnets. The company requires that all traffic between the ALB and web tier, as well as between web tier and application tier, remain within the AWS network and not traverse the internet. The current design uses an Internet Gateway (IGW) for public subnet internet access and a NAT Gateway for private subnet outbound internet access. The web tier instances have a default route to the IGW, and the application tier instances have a default route to the NAT Gateway. The security groups are configured correctly. However, the application tier cannot connect to the RDS database. What is the MOST likely cause?

A.The application tier instances are using the RDS public DNS name instead of the private DNS name

B.The RDS database is in a different VPC

C.The ALB is not configured to forward traffic to the web tier

D.The NAT Gateway is not configured with the correct route to the RDS subnet

AnswerA

Using the public endpoint causes traffic to go to the NAT Gateway, which cannot connect to RDS's public endpoint from private subnet without proper routing.

Why this answer

The RDS database is in private subnets. The application tier instances are also in private subnets. They should be able to communicate within the same VPC via private IP addresses.

The issue is not about internet access. The most likely cause is that the application tier instances are trying to connect to the RDS endpoint using the public DNS name, which resolves to a public IP, and the traffic is being routed to the NAT Gateway, which blocks inbound traffic from the internet (the RDS public endpoint). The application tier should use the private DNS name or the private IP address of the RDS instance.

Alternatively, the security group might be misconfigured, but the question says security groups are correct. The most common mistake is using the public endpoint.

Practice this question →

193

MCQeasy

A solutions architect needs to design a VPC with both IPv4 and IPv6 support. The VPC will have public and private subnets. Resources in private subnets need outbound IPv6 access to the internet. Which combination of resources should be used?

A.Internet gateway for public subnets and VPC gateway endpoints for private subnets

B.Internet gateway for public subnets and NAT gateway for private subnets

C.Internet gateway for both public and private subnets using route tables

D.Internet gateway for public subnets and egress-only internet gateway for private subnets

AnswerD

Egress-only internet gateway provides IPv6 outbound access for private subnets.

Why this answer

An egress-only internet gateway (EIGW) is the AWS-managed service designed specifically to provide outbound-only IPv6 access from private subnets to the internet, while an internet gateway (IGW) handles both inbound and outbound IPv4/IPv6 traffic for public subnets. Unlike a NAT gateway, which only supports IPv4, the EIGW works with IPv6 and prevents any inbound IPv6 connections from the internet, meeting the requirement for outbound-only IPv6 access.

Exam trap

AWS often tests the misconception that a NAT gateway can handle IPv6 traffic, but NAT gateways are IPv4-only; the trap here is confusing the IPv4 outbound solution (NAT gateway) with the IPv6 outbound solution (egress-only internet gateway), or assuming an internet gateway can be used in private subnets with route restrictions.

How to eliminate wrong answers

Option A is wrong because VPC gateway endpoints (e.g., S3, DynamoDB) provide private connectivity to AWS services, not general outbound internet access, and they do not support IPv6 traffic. Option B is wrong because a NAT gateway only supports IPv4 traffic and cannot provide outbound IPv6 access; it is used for IPv4 private subnet internet access. Option C is wrong because placing an internet gateway in private subnet route tables would allow inbound internet traffic (both IPv4 and IPv6) to those subnets, violating the requirement for private subnets that must not be directly reachable from the internet.

Practice this question →

194

Drag & Dropmedium

Arrange the steps to configure an AWS Transit Gateway with attachments to multiple VPCs:

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First create the transit gateway, then create attachments, associate them with a route table, update VPC routes, and test connectivity.

Practice this question →

195

MCQeasy

A company has a VPC with a CIDR of 10.0.0.0/16. They want to connect this VPC to a second VPC with CIDR 10.1.0.0/16 using VPC Peering. The VPCs are in the same account and Region. What is the minimum number of route table entries needed in each VPC to enable full bidirectional communication?

A.Two routes in each VPC's route table: one for the local CIDR and one for the peer CIDR

B.No routes are needed because VPC Peering automatically enables communication

C.One route in each VPC's route table

D.One route in only one VPC's route table

AnswerC

Each VPC needs a route to the peer VPC's CIDR via the peering connection.

Why this answer

VPC peering requires a route in each VPC's route table pointing to the CIDR of the peer VPC, using the peering connection as the target. The local VPC's CIDR is automatically added to the route table by default, so only one additional route per VPC is needed for full bidirectional communication.

Exam trap

The trap here is that candidates assume VPC peering automatically handles routing, similar to a VPN or direct connect, but AWS requires explicit route table entries for each direction.

How to eliminate wrong answers

Option A is wrong because the local CIDR is already present in each VPC's route table by default; adding a second route for the local CIDR is unnecessary. Option B is wrong because VPC peering does not automatically add routes; you must manually add routes to enable traffic flow between the VPCs. Option D is wrong because both VPCs need a route to the peer CIDR; adding a route in only one VPC would allow only unidirectional traffic.

Practice this question →

196

MCQeasy

A company is designing a VPC with public and private subnets. The private subnets need to access the internet for software updates but must not be directly accessible from the internet. Which AWS service should be used to provide internet access to instances in the private subnets?

A.Internet gateway

B.NAT gateway

C.VPC endpoint

D.Transit gateway

AnswerB

NAT gateway provides outbound-only internet access for private subnets.

Why this answer

A NAT gateway enables instances in a private subnet to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound traffic from the internet. It translates the private IP addresses of the instances to the NAT gateway's Elastic IP address using source network address translation (SNAT), and it does not maintain state for inbound connections that were not initiated from within the VPC.

Exam trap

The ANS-C01 exam often tests the misconception that an internet gateway can be used in a private subnet by simply not assigning public IPs, but the trap is that an internet gateway requires the subnet to have a route to it and instances must have public IPs for return traffic to work, which would expose them to inbound internet traffic.

How to eliminate wrong answers

Option A is wrong because an internet gateway allows bidirectional communication between the VPC and the internet; attaching it to a private subnet would make instances directly accessible from the internet, violating the requirement. Option C is wrong because a VPC endpoint provides private connectivity to AWS services (e.g., S3, DynamoDB) over the AWS network, not general internet access for software updates. Option D is wrong because a transit gateway is used to interconnect VPCs and on-premises networks via a central hub; it does not provide internet access to instances in a private subnet.

Practice this question →

197

Multi-Selectmedium

Which TWO statements about AWS Transit Gateway are correct? (Choose two.)

Select 2 answers

A.It provides internet access for attached VPCs

B.It supports transitive routing between attached VPCs

C.It can be shared across AWS accounts using AWS Resource Access Manager

D.It can replace AWS Direct Connect for on-premises connectivity

E.It only supports VPN attachments

AnswersB, C

Transit Gateway allows VPCs to communicate through it.

Why this answer

AWS Transit Gateway (TGW) acts as a central hub that enables transitive routing between all attached VPCs. When you attach multiple VPCs to the same TGW, their route tables are configured to point to the TGW, allowing traffic to flow from one VPC to another through the hub without needing individual VPC peering connections. This transitive behavior is a core feature of TGW, simplifying network architecture and reducing the number of routing paths required.

Exam trap

The ANS-C01 exam often tests the misconception that Transit Gateway provides internet access or replaces Direct Connect, but in reality, TGW is a hub for private routing and requires separate components (IGW, NAT, Direct Connect) for internet or dedicated on-premises connectivity.

Practice this question →

198

MCQeasy

A company needs to provide internet access to instances in a private subnet while preventing inbound connections from the internet. Which AWS service should be used?

A.NAT Gateway

B.Internet Gateway

C.AWS Direct Connect

D.VPC Endpoint

AnswerA

Provides outbound only.

Why this answer

A NAT Gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. It achieves this by translating the private source IP addresses of the instances to the NAT Gateway's Elastic IP address, and by default it does not allow inbound traffic unless an explicit inbound rule is added to the associated route table, which is not recommended for this use case.

Exam trap

AWS often tests the misconception that an Internet Gateway can be used in a private subnet with restrictive security groups or network ACLs, but the trap is that an Internet Gateway inherently allows bidirectional traffic and cannot prevent unsolicited inbound connections at the gateway level, whereas a NAT Gateway is specifically designed for outbound-only internet access.

How to eliminate wrong answers

Option B (Internet Gateway) is wrong because an Internet Gateway allows both outbound and inbound traffic from the internet; attaching it to a private subnet would expose instances to unsolicited inbound connections, violating the requirement. Option C (AWS Direct Connect) is wrong because it establishes a dedicated private network connection from on-premises to AWS, not internet access, and does not inherently provide internet connectivity or block inbound internet traffic. Option D (VPC Endpoint) is wrong because it provides private connectivity to AWS services (e.g., S3, DynamoDB) over the AWS network without traversing the internet, but it does not provide general internet access for instances.

Practice this question →

199

Multi-Selectmedium

A company is designing a network for a multi-tier application that must meet compliance requirements. The architecture includes a VPC with public, private, and database subnets. Which TWO actions should be taken to ensure the database subnets are not directly accessible from the internet? (Select TWO.)

Select 2 answers

A.Attach an Internet Gateway to the database subnets.

B.Create a NAT Gateway in the database subnets.

C.Associate a security group that denies inbound traffic from 0.0.0.0/0.

D.Configure a network ACL on the database subnets to deny inbound traffic from 0.0.0.0/0.

E.Place the database subnets in private subnets.

AnswersD, E

Correct: Network ACLs can deny inbound traffic.

Why this answer

A network ACL (NACL) is a stateless firewall that operates at the subnet level. By configuring a NACL rule to deny inbound traffic from 0.0.0.0/0, you explicitly block all internet-originated traffic from reaching the database subnets, regardless of any security group rules. Option E is correct because placing the database subnets in private subnets means they have no direct route to an Internet Gateway, making them inherently inaccessible from the internet.

Exam trap

The ANS-C01 exam often tests the misconception that a security group deny rule can block inbound traffic from 0.0.0.0/0, but security groups only support allow rules and are stateful, so the correct approach is to use a network ACL deny rule or place the subnets in a private subnet without an Internet Gateway route.

Practice this question →

200

MCQeasy

A company is planning to connect multiple VPCs in different AWS accounts using AWS Transit Gateway. The VPCs must be able to communicate with each other, but the company wants to centralize egress traffic to the internet through a single VPC that has a NAT gateway. Which configuration meets these requirements?

A.Attach all VPCs to a Transit Gateway, create a central egress VPC with a NAT gateway, and configure Transit Gateway route tables to send default traffic to the central VPC.

B.Use AWS Site-to-Site VPN to connect the VPCs and route traffic through a central VPN endpoint.

C.Use VPC peering to connect all VPCs and configure a NAT gateway in one VPC.

D.Attach each VPC to a Transit Gateway and configure a NAT gateway in each VPC.

AnswerA

Centralizes internet egress while allowing VPC-to-VPC communication.

Why this answer

AWS Transit Gateway allows you to attach multiple VPCs from different accounts and centrally manage routing. By configuring the Transit Gateway route tables to send default traffic (0.0.0.0/0) to a central egress VPC that contains a NAT gateway, all other VPCs can route internet-bound traffic through that single NAT gateway, centralizing egress while maintaining inter-VPC communication.

Exam trap

The trap here is that candidates often confuse VPC peering with Transit Gateway, assuming VPC peering supports transitive routing (which it does not), or they think placing a NAT gateway in each VPC is acceptable, missing the explicit requirement for centralized egress.

How to eliminate wrong answers

Option B is wrong because AWS Site-to-Site VPN is designed for connecting on-premises networks to AWS, not for inter-VPC connectivity, and it would introduce unnecessary complexity, latency, and bandwidth limitations. Option C is wrong because VPC peering does not support transitive routing; to connect all VPCs in a mesh, you would need a full mesh of peering connections, which does not scale and still requires manual route table entries in each VPC to direct traffic to the central NAT gateway. Option D is wrong because configuring a NAT gateway in each VPC defeats the requirement to centralize egress traffic; each VPC would have its own independent internet egress, not a single centralized point.

Practice this question →

201

MCQeasy

A company wants to use AWS Direct Connect to connect their on-premises network to a VPC. They have two Direct Connect locations and want high availability. What is the minimum number of Direct Connect virtual interfaces needed?

A.One public VIF and one private VIF

B.Four private VIFs

C.Two private VIFs

D.One private VIF

AnswerC

Two VIFs, each on a separate Direct Connect connection, provide high availability.

Why this answer

For high availability across two Direct Connect locations, you need at least two private virtual interfaces (VIFs), one at each location, each connecting to the same VPC. This ensures that if one Direct Connect connection or location fails, traffic can still flow through the other private VIF. A single private VIF provides no redundancy, and public VIFs are used for accessing public AWS services, not VPC connectivity.

Exam trap

The ANS-C01 exam often tests the misconception that a public VIF is needed for VPC connectivity or that more VIFs automatically mean better availability, when in reality private VIFs are the only type that provide VPC access, and exactly two private VIFs (one per location) meet the minimum high-availability requirement.

How to eliminate wrong answers

Option A is wrong because a public VIF is used for accessing AWS public services (e.g., S3, DynamoDB) and does not provide connectivity to a VPC; mixing a public VIF with a private VIF does not achieve high availability for VPC access. Option B is wrong because four private VIFs exceed the minimum requirement; two private VIFs (one per Direct Connect location) are sufficient for high availability, and additional VIFs are unnecessary and increase complexity. Option D is wrong because a single private VIF creates a single point of failure; if the Direct Connect connection or location fails, connectivity to the VPC is lost, violating high availability requirements.

Practice this question →

202

MCQmedium

A network engineer is troubleshooting a Direct Connect private VIF. The VIF is in 'available' state but traffic is not flowing to the VPC. The VGW is attached to the VPC. What is the most likely cause?

A.The VPC route table lacks a route to the on-premises network pointing to the VGW.

B.The route filter prefix for the VPC CIDR is misconfigured.

C.BGP is not established between the on-premises router and the VGW.

D.The VIF state is not 'available'.

AnswerA

Without this route, traffic cannot be forwarded.

Why this answer

When a Direct Connect private VIF is in the 'available' state, the physical and logical layer 2 connectivity is established, and BGP sessions are typically up. However, traffic still cannot flow to the VPC unless the VPC route table contains a route that directs traffic destined for the on-premises network to the Virtual Private Gateway (VGW). Without this route, the VPC has no path to send traffic over the Direct Connect connection, even though the VIF and BGP are operational.

Exam trap

The trap here is that candidates assume an 'available' VIF and established BGP automatically mean traffic flows, but they overlook the critical requirement of a VPC route table entry pointing to the VGW as the next hop.

How to eliminate wrong answers

Option B is wrong because route filter prefixes control which BGP routes are advertised or accepted, but they do not prevent traffic flow if the VPC route table already has a static route pointing to the VGW; the question states the VIF is available and BGP is likely established, so a misconfigured route filter would affect route propagation, not the immediate lack of a route in the VPC. Option C is wrong because if BGP were not established, the VIF would typically show a 'down' or 'pending' BGP status, but the VIF is 'available' and the issue is traffic not flowing, implying BGP is up. Option D is wrong because the VIF state is explicitly stated as 'available', which means the physical and logical layer 2 connectivity is functioning correctly.

Practice this question →

203

MCQhard

Refer to the exhibit. A network engineer has this IAM policy attached to their user. They attempt to create a VPC peering connection between VPC A (in account 123456789012) and VPC B (in account 210987654321). The request fails. Which additional permission is required?

A.The ec2:CreateVpcPeeringConnection action is not allowed on the accepter VPC.

B.The policy must include a condition that the accepter VPC owner is the target account.

C.The user needs ec2:ModifyVpcPeeringConnectionOptions permission.

D.The user needs ec2:CreateVpcEndpoint permission.

AnswerB

Without a condition, the peering request may be denied if the accepter account is not specified.

Why this answer

When creating a VPC peering connection across AWS accounts, the requester's IAM policy must include a condition that explicitly allows the action only when the accepter VPC owner is the target account. Without this condition, the ec2:CreateVpcPeeringConnection action will fail because the policy lacks the necessary cross-account authorization context. The condition key aws:SourceAccount or ec2:AccepterVpcOwnerId must be used to restrict the action to the specific accepter account.

Exam trap

The ANS-C01 exam often tests the misconception that the ec2:CreateVpcPeeringConnection action alone is sufficient for cross-account peering, but the trap is that the IAM policy must include a condition to specify the accepter account ID, otherwise the request fails due to missing authorization context.

How to eliminate wrong answers

Option A is wrong because the ec2:CreateVpcPeeringConnection action is allowed on the requester VPC, not the accepter VPC; the accepter VPC is specified as a parameter, and the action itself is performed on the requester side. Option C is wrong because ec2:ModifyVpcPeeringConnectionOptions is used to update DNS resolution or other peering options after the connection is established, not to create the peering connection itself. Option D is wrong because ec2:CreateVpcEndpoint is unrelated to VPC peering; it is used to create VPC endpoints for AWS services like S3 or DynamoDB.

Practice this question →

204

MCQhard

Refer to the exhibit. An AWS administrator is troubleshooting an issue where an EC2 instance cannot access an S3 bucket using an instance profile. The instance profile is associated with an IAM role that has the above trust policy. The S3 bucket policy allows s3:GetObject only for the role's ARN. What is the most likely cause of the access failure?

A.The VPC does not have an S3 VPC endpoint

B.The instance profile is not attached to the EC2 instance

C.The S3 bucket policy does not allow s3:ListBucket

D.The trust policy does not allow the S3 service to assume the role

AnswerB

Without the instance profile, the EC2 instance cannot assume the role.

Why this answer

The instance profile must be attached to the EC2 instance for the IAM role's credentials to be available to the instance. Without this attachment, the EC2 instance cannot assume the role or use its permissions to access the S3 bucket, even if the trust policy and bucket policy are correctly configured.

Exam trap

The trap here is that candidates often overlook the instance profile attachment step and instead focus on policy misconfigurations, assuming the trust policy or bucket policy is the issue when the real problem is the missing link between the instance and the role.

How to eliminate wrong answers

Option A is wrong because an S3 VPC endpoint is not required for EC2 instances to access S3 via an instance profile; it is only needed for private connectivity without traversing the internet. Option C is wrong because the s3:GetObject permission is sufficient to read an object; s3:ListBucket is only required for listing objects, not for a direct GetObject request. Option D is wrong because the trust policy in the exhibit allows the EC2 service (not S3) to assume the role, which is correct for an instance profile; the S3 service does not need to assume the role.

Practice this question →

205

MCQmedium

A company is setting up a new AWS Direct Connect connection. They have provisioned a 1 Gbps dedicated connection. They need to create a private virtual interface (VIF) to connect to their VPC. The VIF has been created and is in the 'available' state, but the BGP session is not coming up. What is the most likely cause?

A.The BGP hold timer is set too high on the customer router.

B.The VLAN ID assigned to the VIF is already in use on another VIF.

C.The BGP authentication key does not match between the customer router and AWS.

D.The Direct Connect interface is in the 'down' state.

AnswerC

If BGP MD5 authentication is configured, both sides must have the same key, or the session will not establish.

Why this answer

The most likely cause is a BGP authentication key mismatch. When the BGP session fails to establish but the virtual interface is in the 'available' state, it indicates the Layer 2 (VLAN) and Layer 1 (physical) connectivity are working. BGP authentication uses MD5 (per RFC 2385), and if the pre-shared key configured on the customer router does not exactly match the key specified in the AWS Direct Connect console for the private VIF, the TCP MD5 signature will fail, preventing the BGP session from coming up.

Exam trap

The ANS-C01 exam often tests the distinction between Layer 2 (VIF state) and Layer 3 (BGP session) issues, tricking candidates into thinking a 'down' physical interface or VLAN conflict is the cause when the VIF is already in the 'available' state.

How to eliminate wrong answers

Option A is wrong because a BGP hold timer set too high would not prevent the session from coming up; it would only cause the session to take longer to detect a failure, but the initial OPEN message exchange would still succeed if other parameters match. Option B is wrong because if the VLAN ID were already in use on another VIF, the VIF creation would fail or the interface would show an error state; the VIF being in 'available' state confirms the VLAN ID is unique and accepted. Option D is wrong because the Direct Connect interface being in the 'down' state would prevent the VIF from reaching the 'available' state; the question explicitly states the VIF is 'available', confirming the physical and logical link is up.

Practice this question →

206

MCQmedium

A company has an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The ALB is configured with a target group that has a health check path of /health. Some instances are failing health checks and being marked unhealthy, but the application logs show the instances are healthy. What is the most likely cause?

A.The health check path is incorrect

B.The target group's slow start duration is too long

C.The security group for the instances does not allow inbound traffic from the ALB's security group on the health check port

D.The ALB's stickiness is preventing health checks

AnswerC

The ALB's health checks must be allowed by the instance security group.

Why this answer

The most likely cause is that the security group for the EC2 instances does not allow inbound traffic from the ALB's security group on the health check port. ALB health checks originate from the ALB's private IP addresses, and if the instance security group lacks an inbound rule permitting traffic from the ALB's security group (or its CIDR) on the health check port, the health check requests are dropped, causing the target to be marked unhealthy even though the application itself is running fine.

Exam trap

The trap here is that candidates assume health check failures always indicate application problems, but The ANS-C01 exam often tests the security group misconfiguration where the ALB's health check traffic is blocked, causing a false unhealthy status despite the application being healthy.

How to eliminate wrong answers

Option A is wrong because the health check path /health is explicitly stated as the configured path, and the application logs show the instances are healthy, indicating the path is correct. Option B is wrong because slow start duration only affects how traffic is gradually sent to newly registered targets; it does not impact health check success or failure. Option D is wrong because ALB stickiness (session affinity) is a traffic routing feature based on cookies, and it does not interfere with or prevent health checks from being sent to targets.

Practice this question →

207

MCQmedium

A company has a VPC with a CIDR block of 10.0.0.0/16. It needs to create a secondary CIDR block for additional subnets that must not overlap with the existing CIDR. Which CIDR block should be used?

A.172.16.0.0/16

B.10.0.0.0/16

C.10.0.0.0/8

D.10.1.0.0/16

AnswerA, D

Correct: 172.16.0.0/16 is a private, non-overlapping CIDR from a different RFC 1918 block.

Why this answer

Both A (172.16.0.0/16) and D (10.1.0.0/16) are correct because they are private, non-overlapping secondary CIDRs. The primary CIDR is 10.0.0.0/16; any non-overlapping CIDR is valid, regardless of RFC 1918 class. Options B and C overlap with the primary and therefore cannot be used.

Exam trap

The ANS-C01 exam often tests whether candidates know that secondary CIDRs can be from the same RFC 1918 class as the primary as long as they do not overlap. Many mistakenly eliminate D (10.1.0.0/16) because it is in the 10.0.0.0/8 range, but it is actually valid. Both A and D are acceptable.

How to eliminate wrong answers

Option A is wrong because 172.16.0.0/16 is a valid RFC 1918 private range, but AWS does not allow mixing different RFC 1918 address classes (10.x.x.x, 172.16.x.x, 192.168.x.x) as secondary CIDRs for a VPC; all CIDRs in a VPC must be from the same RFC 1918 class (e.g., all 10.x.x.x). Option B is wrong because 10.0.0.0/16 is identical to the existing CIDR, causing an overlap, which AWS explicitly prohibits when adding a secondary CIDR. Option C is wrong because 10.0.0.0/8 is a supernet that entirely contains the existing 10.0.0.0/16, resulting in overlap; AWS requires secondary CIDRs to be non-overlapping and typically within the same /16 or smaller prefix length.

Practice this question →

208

MCQmedium

Refer to the exhibit. A VPN connection has two tunnels. Which statement is correct about this VPN configuration?

A.The VPN uses BGP dynamic routing

B.The VPN provides high availability with two tunnels

C.The tunnel inside CIDRs are /24 networks

D.Both tunnels use the same inside CIDR

AnswerB

Two tunnels provide redundancy.

Why this answer

The exhibit shows a VPN connection with two tunnels, which is the standard design for AWS Site-to-Site VPN to provide high availability. Each tunnel is on a separate device and path, so if one tunnel fails, traffic automatically fails over to the other tunnel. This ensures that the VPN connection remains operational even during maintenance or failure of a single tunnel.

Exam trap

AWS often tests the misconception that two tunnels in a VPN connection are for load balancing, but in AWS Site-to-Site VPN, they are strictly for high availability (active/standby or active/active with BGP), not for aggregating bandwidth.

How to eliminate wrong answers

Option A is wrong because the VPN configuration shown does not indicate BGP dynamic routing; the tunnels could be using static routing or BGP, but the exhibit alone does not confirm BGP. Option C is wrong because the tunnel inside CIDRs are not necessarily /24 networks; AWS VPN tunnels use /30 or /31 networks for the inside IP addresses. Option D is wrong because both tunnels use different inside CIDRs (e.g., 169.254.10.0/30 and 169.254.11.0/30) to avoid IP overlap and allow independent routing.

Practice this question →

209

MCQeasy

Based on the output, which of the following is true?

A.The Direct Connect Gateway uses ASN 64512

B.The Direct Connect Gateway is in a 'deleted' state

C.The Direct Connect Gateway is a virtual private gateway

D.The Direct Connect Gateway is owned by a different account

AnswerA

The amazonSideAsn is set to 64512.

Why this answer

The output shows the Direct Connect Gateway with ASN 64512, which is a private autonomous system number commonly used for Direct Connect Gateways. This ASN is assigned to the gateway and is visible in the output, confirming that option A is correct.

Exam trap

The ANS-C01 exam often tests the distinction between a Direct Connect Gateway and a virtual private gateway, where candidates confuse the two because both are used for hybrid connectivity, but they serve different purposes and use different ASN configurations.

How to eliminate wrong answers

Option B is wrong because the output does not indicate a 'deleted' state; the gateway is listed with an active state and associated VIFs. Option C is wrong because a Direct Connect Gateway is a distinct resource from a virtual private gateway (VPG) — VPGs are used for VPN connections, not Direct Connect. Option D is wrong because the output does not show any cross-account ownership; the gateway is owned by the same account as indicated by the consistent account ID in the output.

Practice this question →

210

Multi-Selecthard

A company is setting up a Site-to-Site VPN connection between their on-premises network and AWS. Which THREE components are required for a VPN connection?

Select 3 answers

A.VPN Tunnel

B.Transit Gateway

C.Internet Gateway

D.Virtual Private Gateway

E.Customer Gateway

AnswersA, D, E

Encrypted connection.

Why this answer

A VPN tunnel is a required component for an AWS Site-to-Site VPN connection because it provides the encrypted, secure communication channel between the on-premises customer gateway and the AWS virtual private gateway. Each VPN connection consists of two tunnels for high availability, each using IPsec (IKEv1 or IKEv2) to encrypt traffic. Without at least one VPN tunnel, no encrypted data can traverse the VPN connection.

Exam trap

AWS often tests the misconception that a Transit Gateway is a required component for a Site-to-Site VPN, but the correct required components are only the VPN Tunnel, Virtual Private Gateway, and Customer Gateway.

Practice this question →

211

MCQeasy

A company has an on-premises data center connected to AWS via a Site-to-Site VPN. The VPN connection uses BGP for dynamic routing. The company wants to add an additional VPN tunnel for redundancy. What must be configured?

A.Create a second virtual private gateway and attach it to the VPC.

B.Add a transit gateway to replace the virtual private gateway.

C.Create a second VPN connection to a second customer gateway device.

D.Configure static routes instead of BGP.

AnswerC

Provides redundant tunnels.

Why this answer

To add an additional VPN tunnel for redundancy, you must create a second VPN connection that uses a second customer gateway device. This provides a second BGP session and a separate tunnel, ensuring failover if the primary tunnel or customer gateway fails. The existing virtual private gateway can support multiple VPN connections, so no replacement or additional VGW is needed.

Exam trap

The trap here is that candidates assume you need a second virtual private gateway for redundancy, but AWS allows multiple VPN connections to the same VGW, so the correct approach is to add a second VPN connection with a separate customer gateway device.

How to eliminate wrong answers

Option A is wrong because a single VPC can only have one virtual private gateway attached at a time; you cannot attach a second VGW to the same VPC. Option B is wrong because replacing the VGW with a transit gateway is unnecessary for simply adding a redundant VPN tunnel; a transit gateway is used for complex multi-VPC or hybrid network topologies, not for basic VPN redundancy. Option D is wrong because switching from BGP to static routes would eliminate the dynamic failover and route propagation benefits that BGP provides, which is counterproductive for redundancy.

Practice this question →

212

MCQeasy

A company has a VPC peering connection between VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). They have added routes in both route tables. However, instances in VPC A cannot ping instances in VPC B. The security groups and network ACLs allow ICMP. What is the most likely cause?

A.The security groups in VPC B do not allow inbound ICMP from VPC A CIDR

B.The route tables in VPC A do not have a route to VPC B CIDR pointing to the peering connection

C.The VPC peering connection is not in the 'active' state

D.The instances are in different Availability Zones

AnswerB

Without a specific route to the peered VPC CIDR, traffic will not be sent over the peering connection.

Why this answer

The question states that routes have been added in both route tables, but the most likely cause is that the route in VPC A's route table does not point to the VPC peering connection as the target. Without a specific route for VPC B's CIDR (10.1.0.0/16) with the peering connection ID as the target, traffic from VPC A to VPC B will not be forwarded over the peering link, even if security groups and NACLs permit ICMP.

Exam trap

The trap here is that candidates often assume that simply creating a VPC peering connection and adding routes generically is sufficient, but they overlook the requirement that the route must explicitly point to the peering connection ID as the target, not just any route to the peer CIDR.

How to eliminate wrong answers

Option A is wrong because the question explicitly states that security groups allow ICMP, and even if they didn't, the issue is at the routing layer, not the security layer. Option C is wrong because if the peering connection were not in the 'active' state, the instances would not be able to communicate at all, but the question describes a scenario where routes have been added, implying the peering exists and is accepted; a non-active state would prevent route propagation and is less likely than a missing route. Option D is wrong because VPC peering works across Availability Zones; instances in different AZs can communicate over a peering connection as long as routing and security are correctly configured.

Practice this question →

213

Multi-Selecthard

A company is designing a hybrid network using AWS Direct Connect. They have a VPC with CIDR 10.0.0.0/16 and an on-premises network with CIDR 192.168.0.0/16. They want to establish a Direct Connect private virtual interface with a virtual private gateway. Which THREE steps are required to complete the connectivity? (Choose three.)

Select 3 answers

A.Create a Transit Gateway and attach the VPC to it.

B.Create a virtual private gateway and attach it to the VPC.

C.Update the VPC route table to add a route for the on-premises CIDR pointing to the virtual private gateway.

D.Configure a private virtual interface on the Direct Connect connection, associating it with the virtual private gateway.

E.Create a customer gateway object in the AWS account.

AnswersB, C, D

The virtual private gateway is the AWS side endpoint for the Direct Connect private virtual interface.

Why this answer

A virtual private gateway (VGW) is the required AWS-side endpoint for a Direct Connect private virtual interface (VIF) to terminate on a single VPC. The VGW must be created and attached to the VPC before the private VIF can be associated with it, enabling private connectivity between the on-premises network and the VPC.

Exam trap

The trap here is that candidates confuse the customer gateway object (used for VPN) with the virtual private gateway (used for Direct Connect), leading them to incorrectly select Option E as a required step.

Practice this question →

214

MCQeasy

A company is designing a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. The database should not have direct internet access. Which architecture meets these requirements?

A.Place the web server in the public subnet with an Internet Gateway, and the database in the private subnet without any internet access.

B.Place both instances in the public subnet and use security groups to restrict inbound access to the database.

C.Place the web server in the public subnet with an Internet Gateway, and the database in the private subnet with a route to a NAT Gateway in the public subnet for outbound access only.

D.Place the web server in the private subnet with a NAT Gateway, and the database in the public subnet with an Internet Gateway.

AnswerC

Web server gets internet via IGW; database can initiate outbound traffic via NAT Gateway without being directly reachable.

Why this answer

It places the web server in a public subnet with a route to an Internet Gateway (IGW) for direct outbound internet access to download patches, while the database resides in a private subnet with a route to a NAT Gateway in the public subnet. The NAT Gateway enables outbound-only internet access for the database (e.g., for license validation or updates) without exposing it to unsolicited inbound connections, meeting the requirement that the database should not have direct internet access.

Exam trap

The trap here is that candidates often assume a private subnet must have zero internet access, forgetting that outbound-only access via a NAT Gateway is allowed and commonly required for patching or updates, while a public subnet with an IGW is for bidirectional internet access.

How to eliminate wrong answers

Option A is wrong because placing the database in a private subnet without any internet access prevents it from performing necessary outbound operations (e.g., contacting license servers or sending logs), which is overly restrictive and not aligned with the requirement that only direct inbound internet access is prohibited. Option B is wrong because placing both instances in a public subnet exposes the database to the internet; security groups alone cannot prevent the database from having a public IP address or being reachable from the internet if the subnet has a route to an IGW, violating the 'no direct internet access' requirement. Option D is wrong because placing the web server in a private subnet with a NAT Gateway would force all its internet traffic through the NAT, adding unnecessary latency and cost, while placing the database in a public subnet with an IGW directly exposes it to the internet, contradicting the requirement.

Practice this question →

215

MCQeasy

A company wants to ensure that traffic between EC2 instances in the same VPC but different subnets is encrypted. Which solution should be used?

A.Use security groups to allow traffic.

B.Use VPC Peering.

C.Use network ACLs to allow traffic.

D.Use IPsec VPN between the instances.

AnswerD

IPsec provides encryption for traffic between instances.

Why this answer

An IPsec VPN between EC2 instances creates an encrypted tunnel at Layer 3, ensuring that all traffic between the instances is encrypted regardless of the underlying network path. This is necessary because traffic within a VPC traversing different subnets is not encrypted by default, even though it stays within the AWS network.

Exam trap

The trap here is that candidates confuse network-layer access control (security groups, NACLs) with encryption, assuming that allowing traffic through a firewall or using VPC Peering inherently secures the data, when in fact neither provides confidentiality or integrity of the payload.

How to eliminate wrong answers

Option A is wrong because security groups act as a virtual firewall at the instance level, controlling allowed traffic based on IP addresses and ports, but they do not provide encryption of the traffic itself. Option B is wrong because VPC Peering connects two VPCs at Layer 3 and does not encrypt traffic between them; it simply routes packets without any encryption overhead. Option C is wrong because network ACLs are stateless packet filters at the subnet boundary that allow or deny traffic based on rules, but they do not encrypt the data payload.

Practice this question →

216

MCQhard

A company is designing a network for a real-time trading application that requires extremely low latency (sub-millisecond) between two EC2 instances located in the same AWS region. The instances are in different Availability Zones. The trading application uses a proprietary protocol over TCP. The company wants to minimize latency as much as possible. They are considering using a placement group. Which type of placement group should they use, and what network optimization should they apply?

A.Use a spread placement group and enable dedicated tenancy

B.Use a partition placement group and enable EBS-optimized instances

C.Use a cluster placement group for both instances and enable enhanced networking (SR-IOV)

D.Use a cluster placement group but launch instances in different Availability Zones

AnswerC

Cluster placement group provides low latency; enhanced networking reduces overhead.

Why this answer

A cluster placement group is the only placement group type that provides low-latency, high-bandwidth network performance by placing instances in a single Availability Zone within the same rack. Enhanced networking using SR-IOV (Single Root I/O Virtualization) bypasses the hypervisor's network stack, reducing per-packet processing latency and jitter, which is critical for sub-millisecond trading traffic over TCP.

Exam trap

AWS often tests the misconception that a cluster placement group can span multiple Availability Zones, but in reality, it is confined to a single AZ to guarantee low-latency physical proximity.

How to eliminate wrong answers

Option A is wrong because spread placement groups spread instances across distinct hardware to reduce failure risk, which increases network distance and latency, and dedicated tenancy does not improve network performance. Option B is wrong because partition placement groups isolate instances across logical partitions for large distributed workloads, not for low latency, and EBS-optimized instances improve storage throughput, not network latency. Option D is wrong because a cluster placement group requires all instances to be in the same Availability Zone to achieve low latency; placing instances in different Availability Zones negates the benefit and introduces cross-AZ latency.

Practice this question →

217

MCQeasy

A company wants to connect its VPC to an on-premises data center using AWS Direct Connect. The company has two Direct Connect locations in the same AWS region. For high availability, they plan to establish two separate connections. Which configuration ensures that if one connection fails, traffic automatically fails over to the other?

A.Establish one Direct Connect connection and one AWS Site-to-Site VPN connection as backup.

B.Establish two Direct Connect connections from the same Direct Connect location to the same VPC.

C.Establish two Direct Connect connections from different Direct Connect locations to the same VPC, each with a private VIF attached to the same virtual private gateway.

D.Establish a single Direct Connect connection with two virtual interfaces (VIFs) to the same VPC.

AnswerC

Different locations provide physical diversity; BGP routing handles failover automatically.

Why this answer

It provides true high availability by using two Direct Connect connections from different geographic locations, each with a private virtual interface (VIF) attached to the same virtual private gateway (VGW). This configuration ensures that if one connection fails, BGP sessions automatically withdraw the affected routes, and traffic is rerouted over the remaining connection via the VGW's active/active or active/passive routing behavior.

Exam trap

The ANS-C01 exam often tests the misconception that multiple connections from the same Direct Connect location provide sufficient redundancy, but the trap here is that a single location is a common failure domain, so you must use different locations to achieve true high availability.

How to eliminate wrong answers

Option A is wrong because using a Site-to-Site VPN as a backup to a single Direct Connect connection does not provide automatic failover within the same network path; VPNs have lower bandwidth and higher latency, and failover requires manual or scripted route manipulation unless using BGP with a VPN connection, which is not the scenario described. Option B is wrong because establishing two Direct Connect connections from the same location creates a single point of failure at that location; if the location goes down, both connections fail, violating high-availability requirements. Option D is wrong because a single Direct Connect connection with two virtual interfaces still relies on a single physical link; if the physical connection fails, both VIFs go down, providing no redundancy.

Practice this question →

218

MCQeasy

A company is designing a network for a new VPC. They want to ensure that the VPC can connect to an on-premises data center via a site-to-site VPN. The on-premises network uses a CIDR block of 10.0.0.0/8. The VPC will use a CIDR block of 10.0.0.0/16. The network engineer is concerned about overlapping IP addresses. What is the best way to avoid IP address overlap?

A.Use the same CIDR block and rely on NAT

B.Use a different RFC 1918 CIDR block for the VPC

C.Use a smaller subnet within the same 10.0.0.0/8 range

D.Use a public IP range for the VPC

AnswerB

Avoids overlap.

Why this answer

Using a different RFC 1918 CIDR block (e.g., 172.16.0.0/12 or 192.168.0.0/16) for the VPC completely avoids IP address overlap with the on-premises 10.0.0.0/8 network. Overlapping CIDR blocks (both using 10.0.0.0/8) would prevent successful route propagation and cause asymmetric routing or connectivity failures in the site-to-site VPN. NAT can mitigate overlap but adds complexity and is not the 'best' design choice when a non-overlapping private range is available.

Exam trap

AWS often tests the misconception that NAT can always solve IP overlap issues, but the best practice is to design non-overlapping private IP spaces from the start to avoid complexity and routing failures.

How to eliminate wrong answers

Option A is wrong because using the same CIDR block (10.0.0.0/16 within 10.0.0.0/8) creates an overlap that NAT alone cannot fully resolve for bidirectional traffic without complex rules and potential performance issues; it is not the best architectural practice. Option C is wrong because using a smaller subnet within the same 10.0.0.0/8 range still overlaps with the on-premises network, as the on-premises CIDR encompasses the entire 10.0.0.0/8 space, leading to routing conflicts. Option D is wrong because using a public IP range for the VPC violates RFC 1918 private addressing best practices, is not routable over a VPN without additional NAT or BGP complexities, and can cause conflicts with internet-bound traffic.

Practice this question →

219

Multi-Selecthard

Which THREE factors should be considered when designing a VPC for a multi-tier application that requires high availability and security? (Choose three.)

Select 3 answers

A.Provision subnets in at least two Availability Zones

B.Assign public IP addresses to all instances for direct access

C.Use separate subnets for web, application, and database tiers

D.Use a single Availability Zone to reduce latency

E.Use NAT Gateways in public subnets for outbound internet access from private subnets

AnswersA, C, E

Provides high availability in case of AZ failure.

Why this answer

Deploying subnets across at least two Availability Zones (AZs) ensures high availability by eliminating a single point of failure. If one AZ experiences an outage, the application can continue serving traffic from the other AZ. This is a foundational principle for building fault-tolerant architectures in AWS.

Exam trap

AWS often tests the misconception that high availability can be achieved within a single Availability Zone by using redundant components, but the correct approach requires at least two AZs to survive an AZ-level failure.

Practice this question →

220

Multi-Selecthard

A company has a VPC with a public subnet and a private subnet. The private subnet needs to access an S3 bucket for backups. Which TWO actions are required to provide private connectivity to S3 without using a NAT Gateway?

Select 2 answers

A.Create a NAT Gateway in the public subnet.

B.Create a VPC Gateway Endpoint for S3.

C.Add a route for the S3 prefix list in the private subnet route table pointing to the gateway endpoint.

D.Create a VPC Interface Endpoint for S3.

E.Create a VPC Peering connection to an S3 VPC.

AnswersB, C

Gateway Endpoint provides private S3 access.

Why this answer

A VPC Gateway Endpoint provides private connectivity to S3 without traversing the internet or requiring a NAT Gateway. It uses AWS’s internal network to route traffic from the private subnet to S3, ensuring data never leaves the AWS backbone. This is the most cost-effective and secure method for private S3 access within a VPC.

Exam trap

The trap here is that candidates often confuse VPC Gateway Endpoints with VPC Interface Endpoints, assuming both are equally valid for private S3 access, but the question specifically requires two actions that do not use a NAT Gateway, and the correct pair (Gateway Endpoint + route) is the only combination that meets the criteria without additional costs or complexity.

Practice this question →

221

MCQhard

A company has a VPC with public and private subnets in three Availability Zones. They have an Application Load Balancer (ALB) in the public subnets and a fleet of EC2 instances in the private subnets. The ALB needs to send traffic to the instances on port 443. What is the most secure way to configure the security groups?

A.ALB SG: inbound from 0.0.0.0/0 on all ports. Instance SG: inbound from ALB SG on all ports.

B.ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from 0.0.0.0/0 on port 443.

C.ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from ALB SG on port 443.

D.ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from ALB SG on all ports.

AnswerC

Only allows HTTPS from ALB SG to instances.

Why this answer

It follows the principle of least privilege by restricting the ALB security group to only allow inbound traffic on port 443 from the internet (0.0.0.0/0) and the instance security group to only allow inbound traffic on port 443 from the ALB security group. This ensures that only the ALB can communicate with the instances on the required port, preventing direct access from other sources and reducing the attack surface.

Exam trap

The trap here is that candidates often assume that allowing traffic from 0.0.0.0/0 to the instances is acceptable because the instances are in private subnets, but security groups are stateful and do not consider subnet routing; they evaluate traffic based on the source IP, so a rule allowing 0.0.0.0/0 would permit direct internet traffic if the instances had a route to an internet gateway.

How to eliminate wrong answers

Option A is wrong because it allows inbound traffic to the ALB on all ports from the internet, which is overly permissive and violates security best practices. Option B is wrong because it allows inbound traffic to the instances directly from 0.0.0.0/0 on port 443, bypassing the ALB and exposing the instances to the internet, which is insecure. Option D is wrong because it allows inbound traffic to the instances from the ALB security group on all ports, which is unnecessary and violates the principle of least privilege since only port 443 is required.

Practice this question →

222

Multi-Selectmedium

A company is deploying a containerized application on Amazon ECS using the Fargate launch type. The application requires outbound internet access to download updates, but the company does not want to assign public IP addresses to the tasks. Which TWO actions should the company take to provide internet access to the tasks? (Choose two.)

Select 2 answers

A.Configure a security group that allows outbound traffic to 0.0.0.0/0

B.Launch the tasks in private subnets that do not have a route to an Internet Gateway

C.Create a NAT gateway in a public subnet and update the route tables for the task subnets to route 0.0.0.0/0 traffic to the NAT gateway

D.Launch the tasks in public subnets with auto-assign public IP enabled

E.Create a VPC Gateway Endpoint for Amazon ECR

AnswersB, C

Private subnets ensure no public IPs are assigned; outbound traffic goes through the NAT gateway.

Why this answer

Tasks in private subnets without a route to an Internet Gateway cannot directly access the internet, which is the desired behavior to avoid public IP addresses. Option C is correct because a NAT gateway in a public subnet provides outbound internet access for tasks in private subnets by translating their private IP addresses to the NAT gateway's public IP, allowing them to reach the internet without assigning public IPs to the tasks.

Exam trap

AWS often tests the misconception that a security group rule allowing outbound traffic to 0.0.0.0/0 alone is sufficient for internet access, when in fact the subnet's route table must direct traffic to a NAT gateway or Internet Gateway.

Practice this question →

223

Multi-Selecthard

Which THREE of the following are benefits of using AWS Global Accelerator over Amazon CloudFront for a global application that uses TCP traffic? (Select THREE.)

Select 3 answers

A.Provides content caching at edge locations.

B.Provides static IP addresses that act as a fixed entry point.

C.Supports TCP and UDP traffic.

D.Can be used with Application Load Balancers as endpoints.

E.Automatically integrates with AWS WAF and AWS Shield Advanced.

AnswersB, C, D

Global Accelerator provides anycast IPs.

Why this answer

AWS Global Accelerator provides static IP addresses that act as a fixed entry point for your application, which is a key benefit over Amazon CloudFront. CloudFront uses dynamic, regional edge IP addresses that can change, whereas Global Accelerator offers two static anycast IP addresses that remain constant, simplifying DNS management and firewall whitelisting for TCP-based global applications.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator with CloudFront, assuming both provide caching and similar features, but Global Accelerator focuses on network performance optimization for TCP/UDP traffic without caching, while CloudFront is a CDN that caches content and primarily supports HTTP/HTTPS.

Practice this question →

224

MCQhard

A company is deploying a multi-tier application in a VPC. The web tier is in public subnets, and the application tier is in private subnets. The application tier needs to communicate with an on-premises database via an AWS Direct Connect connection. The company wants to minimize latency and maximize throughput. Which design should they use?

A.Place the application tier instances in a private subnet in the same VPC as the web tier. Attach a virtual private gateway to the VPC and connect it to the on-premises network via a Direct Connect private virtual interface.

B.Place the application tier in a private subnet and use a NAT Gateway to route traffic to the on-premises network.

C.Place the application tier in a separate VPC and peer it to the web tier VPC. Use a Direct Connect connection attached to the web tier VPC.

D.Place the application tier in a separate VPC and use a VPN connection over the internet to connect to on-premises.

AnswerA

This provides low-latency, high-throughput connectivity directly between the application tier and on-premises.

Why this answer

A Direct Connect private virtual interface (VIF) connected to a virtual private gateway (VGW) provides a dedicated, low-latency, high-throughput connection from the VPC to on-premises. The application tier in the private subnet can route traffic directly to the on-premises database via the VGW without traversing the internet or a NAT device, minimizing latency and maximizing throughput.

Exam trap

AWS often tests the misconception that a NAT Gateway or VPN can provide equivalent performance to Direct Connect, but the trap here is that NAT Gateways are for internet egress only and VPNs introduce internet-based latency, whereas a private VIF offers dedicated, consistent performance.

How to eliminate wrong answers

Option B is wrong because a NAT Gateway is used for outbound internet traffic from private subnets, not for routing to on-premises networks over Direct Connect; it would add unnecessary latency and does not leverage the private VIF. Option C is wrong because placing the application tier in a separate VPC and peering it to the web tier VPC introduces an extra hop (VPC peering) and requires the Direct Connect to be attached to the web tier VPC, which forces traffic to traverse the peering connection, increasing latency and complexity. Option D is wrong because a VPN connection over the internet introduces variable latency, potential throughput bottlenecks, and security risks compared to a dedicated Direct Connect private VIF, failing to minimize latency and maximize throughput.

Practice this question →

225

MCQeasy

A company needs to connect two VPCs in the same AWS account and region. They want to use private IP addresses and avoid any single point of failure. Which solution should they use?

A.AWS Transit Gateway

B.VPC peering connection

C.Internet Gateway and public IPs

D.AWS Site-to-Site VPN between the VPCs

AnswerB

VPC peering is simple, uses private IPs, and has no single point of failure as it is a direct connection.

Why this answer

VPC peering is the correct solution because it allows direct connectivity between two VPCs using private IP addresses, with no single point of failure since traffic flows directly between the VPCs without any intermediate device or bandwidth bottleneck. AWS handles the underlying routing and redundancy, and there is no additional cost for data transfer within the same Availability Zone or region when using private IPs.

Exam trap

The ANS-C01 exam often tests the misconception that Transit Gateway is always the best choice for any multi-VPC connectivity, but the trap here is that for exactly two VPCs in the same account and region, VPC peering is simpler, cheaper, and avoids the single point of failure inherent in a Transit Gateway.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway introduces a single point of failure at the Transit Gateway level (unless you deploy multiple Transit Gateways in a complex, costly setup), and it is overkill for connecting just two VPCs in the same account and region. Option C is wrong because Internet Gateways and public IPs expose traffic to the public internet, violating the requirement to use private IP addresses and introducing security risks and potential failure points. Option D is wrong because an AWS Site-to-Site VPN between VPCs requires a virtual private gateway in each VPC and creates a single point of failure at the VPN connection (unless you configure redundant tunnels, but even then the VPN endpoints are still a bottleneck), and it introduces unnecessary complexity and latency compared to a simple VPC peering connection.

Practice this question →