CCNA Network Design Questions — Page 7 of 7

451

MCQmedium

A company is designing a multi-region application with an Application Load Balancer (ALB) in us-east-1 and us-west-2. They want to route traffic to the nearest region using latency-based routing. Which AWS service should they use to achieve this?

A.AWS Global Accelerator

B.AWS Transit Gateway

C.Amazon CloudFront with multiple origins

D.Amazon Route 53 with latency routing policy

AnswerD

Amazon Route 53’s latency routing policy directs traffic to the region with the lowest network latency for each user, satisfying the requirement to route to the nearest region in a multi-region ALB deployment. This policy uses latency measurements between AWS regions and the client’s DNS resolver, not geographic distance, to select the optimal endpoint.

Why this answer

Route 53's latency routing policy directs traffic to the region with the lowest network latency for the end user, based on measurements between AWS regions and the client's DNS resolver. This directly meets the requirement to route traffic to the nearest region without adding any additional infrastructure or cost beyond DNS queries.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator's Anycast routing with DNS-based latency routing, but Global Accelerator optimizes network path performance for TCP/UDP traffic at the transport layer, not DNS-level latency-based routing for ALB endpoints.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator uses Anycast IPs and the AWS global network to route traffic to the optimal endpoint, but it does not use latency-based DNS routing; it operates at the network layer (Layer 3/4) and is designed for TCP/UDP traffic, not for HTTP/HTTPS ALB routing based on latency. Option B is wrong because AWS Transit Gateway is a network transit hub used to interconnect VPCs and on-premises networks via a central router, not a DNS-based traffic routing service; it has no capability to route traffic based on latency or user location. Option C is wrong because CloudFront with multiple origins can route requests to different origins based on geographic or latency-based behaviors, but it is a CDN service that caches content at edge locations; for dynamic traffic that must reach the ALB directly without caching, CloudFront adds unnecessary latency and complexity, and its latency-based origin routing is not as granular or cost-effective as Route 53 latency routing for this specific use case.

Practice this question →

452

MCQmedium

Refer to the exhibit. A network engineer is analyzing VPC Flow Logs for an EC2 instance with IP 10.0.1.5. Based on the logs, which statement is true?

A.The instance is not communicating with the internet

B.The instance's security group is blocking traffic

C.The instance is only communicating with another instance in the same subnet

D.The instance is communicating with both internal and internet hosts

AnswerD

Logs show internal (10.0.1.8) and internet (203.0.113.5) traffic.

Why this answer

The VPC Flow Logs show the EC2 instance (10.0.1.5) communicating with both an internal IP (10.0.2.10) on port 443 and an external IP (203.0.113.50) on port 80, with ACCEPT records for both flows. This indicates successful bidirectional traffic to both internal and internet hosts, confirming option D is correct.

Exam trap

AWS often tests the misconception that any traffic to a non-RFC 1918 IP automatically implies internet access, but the trap here is that candidates may overlook the ACCEPT status and assume security group blocking, or misinterpret internal IPs as being in the same subnet when they are not.

How to eliminate wrong answers

Option A is wrong because the logs show an ACCEPT record for traffic to 203.0.113.50:80, which is a public IP, proving the instance is communicating with the internet. Option B is wrong because all logged flows show ACCEPT status, meaning neither the security group nor network ACLs are blocking traffic; a blocked flow would show REJECT or SKIPDATA. Option C is wrong because the instance communicates with 10.0.2.10 (different subnet) and 203.0.113.50 (internet), not just another instance in the same subnet.

Practice this question →

453

Multi-Selecthard

A company has a VPC with a CIDR of 10.0.0.0/16. It creates a subnet 10.0.1.0/24 in us-east-1a and launches an EC2 instance with a private IP 10.0.1.10. The instance needs to send traffic to an on-premises server at 192.168.1.50 over a Direct Connect private VIF. The VPC has a virtual private gateway attached and a route table associated with the subnet. Which TWO entries must exist in the route table for the traffic to succeed?

Select 2 answers

A.Destination: 0.0.0.0/0, Target: igw-xxxxxxxx

B.Destination: 0.0.0.0/0, Target: nat-xxxxxxxx

C.Destination: 10.0.0.0/16, Target: local

D.Destination: 192.168.1.0/24, Target: vgw-xxxxxxxx

E.Destination: 10.0.1.0/29, Target: local

AnswersC, D

Correct. The local route for the VPC CIDR is automatically added and allows the instance to communicate within the VPC. This is necessary as the instance sends traffic to the on-premises server, and the route table must have a local entry for the VPC.

Why this answer

For traffic from an EC2 instance in a VPC to an on-premises server over a Direct Connect private VIF, the route table must include two entries: a local route for the VPC CIDR (10.0.0.0/16) which is automatically added and enables communication within the VPC (Option C), and a specific route to the on-premises network (192.168.1.0/24) pointing to the virtual private gateway (vgw-xxxxxxxx) so that traffic destined for 192.168.1.50 is directed over the Direct Connect (Option D). No other entries are required; the local route already covers all subnets, and there is no need for a default route to the internet.

Exam trap

The trap is that candidates might think a default route to a NAT gateway or internet gateway is required for any outbound traffic, but the question specifically asks only about traffic to the on-premises server. The correct required routes are only the local route and the specific route to the on-premises network.

Practice this question →

454

MCQhard

A company is running a multi-tier web application across two AWS Regions (us-east-1 and eu-west-1) for disaster recovery. The application uses an Application Load Balancer (ALB) in each Region. The company uses Amazon Route 53 with latency-based routing to direct traffic to the closest Region. Recently, during a regional failure in us-east-1, users experienced timeouts instead of being redirected to eu-west-1. The DNS TTL is set to 60 seconds. The Route 53 health checks for the us-east-1 ALB are configured to check the HTTP endpoint every 30 seconds with 3 consecutive failures required to mark it unhealthy. The eu-west-1 ALB is healthy. The company's network design includes a VPC in each Region with public and private subnets. The ALBs are internet-facing and have proper security groups. The Route 53 records are configured correctly. What is the MOST likely cause of the timeout?

A.The latency-based routing policy does not fail over to the other region when a health check fails.

B.The ALB in us-east-1 is not configured to be cross-zone load balancing, causing it to fail.

C.The health check interval and failure threshold cause a delay in detecting the failure, and DNS caching causes clients to still resolve to the unhealthy endpoint.

D.The Route 53 health check is not able to reach the ALB in us-east-1 from eu-west-1 due to network ACLs.

AnswerC

The health check takes up to 90 seconds to mark unhealthy, and DNS TTL of 60 seconds extends the impact.

Why this answer

The most likely cause is that the health check interval and failure threshold create a delay in detection, and DNS caching causes clients to still resolve to the unhealthy endpoint. Route 53 health checks check the endpoint every 30 seconds and require 3 consecutive failures to mark it unhealthy, resulting in up to 90 seconds (3 * 30s) before the health check fails. Additionally, DNS resolvers cache the resolved IP address for the TTL of 60 seconds.

Therefore, even after the health check marks the endpoint unhealthy, some clients may still have the cached IP and attempt to connect to the failed us-east-1 ALB, causing timeouts. Option A is incorrect because latency-based routing does fail over when health checks fail; the issue is the delay. Option B is incorrect because cross-zone load balancing is irrelevant to multi-region failover.

Option D is incorrect because Route 53 health checks are global and can reach any region.

Practice this question →

455

MCQmedium

A company is designing a hybrid network architecture that connects an on-premises data center to AWS using AWS Direct Connect. The company wants to ensure high availability and avoid a single point of failure. The on-premises router connects to two separate AWS Direct Connect locations. Which configuration should be used to meet these requirements?

A.Create two private VIFs on the same Direct Connect connection and connect each to a different VPC.

B.Create a single private virtual interface (VIF) on one Direct Connect connection and connect it to a single VPC.

C.Create two Direct Connect connections, each with a private VIF, and connect them to a Direct Connect gateway that is associated with a Transit VPC.

D.Create a Direct Connect gateway and attach a single private VIF from one connection.

AnswerC

Provides redundancy with two separate connections and a Transit VPC.

Why this answer

It uses two separate Direct Connect connections, each with a private VIF, both attached to a Direct Connect gateway. This eliminates a single point of failure at the connection level and, when combined with a Transit VPC, provides redundant, highly available connectivity from the on-premises data center to multiple VPCs. The Direct Connect gateway aggregates the private VIFs and allows traffic to be forwarded to the Transit VPC, which then routes to the attached VPCs, ensuring no single component failure disrupts the hybrid network.

Exam trap

AWS often tests the misconception that multiple VIFs on a single connection or a single VIF attached to a Direct Connect gateway provide high availability, but the trap is that the physical connection itself remains a single point of failure unless two separate Direct Connect connections are used.

How to eliminate wrong answers

Option A is wrong because creating two private VIFs on the same Direct Connect connection does not eliminate the single point of failure; if that single physical connection fails, both VIFs go down. Option B is wrong because a single private VIF on one Direct Connect connection creates a single point of failure; if the connection or VIF fails, all connectivity to AWS is lost. Option D is wrong because attaching a single private VIF from one connection to a Direct Connect gateway still relies on a single Direct Connect connection, leaving the architecture vulnerable to a failure of that connection.

Practice this question →

456

MCQhard

A company is migrating its on-premises data center to AWS. The network team needs to design a hybrid connectivity solution that provides high availability with a bandwidth of at least 10 Gbps and low latency for real-time data replication. The company has two redundant on-premises routers connected to two separate internet service providers (ISPs). Which combination of AWS services should the company use to meet these requirements?

A.Use AWS Direct Connect Gateway to aggregate multiple VPN connections to achieve higher bandwidth.

B.Provision a single AWS Direct Connect connection with a 10 Gbps port and connect both on-premises routers to it via a single interface.

C.Provision two AWS Direct Connect connections at two different Direct Connect locations, each with a 10 Gbps port, and connect each on-premises router to one of them.

D.Set up two AWS Site-to-Site VPN tunnels from each on-premises router to two different AWS VPN endpoints in the same region.

AnswerC

Provides high availability and meets bandwidth/latency requirements.

Why this answer

Provisioning two AWS Direct Connect connections at two different Direct Connect locations, each with a 10 Gbps port, and connecting each on-premises router to one of them provides both high availability (via geographic and path redundancy) and the required 10 Gbps bandwidth with low latency for real-time data replication. This design eliminates single points of failure and meets the bandwidth requirement without relying on VPNs, which cannot guarantee consistent low latency or 10 Gbps throughput.

Exam trap

The trap here is that candidates often assume a single Direct Connect connection with redundant routers on-premises is sufficient for high availability, but they overlook that the Direct Connect connection itself (including the physical fiber and the AWS Direct Connect location) is a single point of failure, requiring two separate connections at different locations to meet true high availability.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect Gateway does not aggregate VPN connections; it is a transit hub that interconnects Direct Connect connections and VPNs, but VPNs themselves are limited by internet-based encryption overhead and cannot reliably achieve 10 Gbps bandwidth or the low latency required for real-time replication. Option B is wrong because a single Direct Connect connection with a 10 Gbps port and a single interface creates a single point of failure; if the connection or location fails, the entire hybrid connectivity is lost, violating the high availability requirement. Option D is wrong because two AWS Site-to-Site VPN tunnels from each on-premises router to two different VPN endpoints still rely on the public internet, which introduces variable latency, jitter, and bandwidth limitations (typically up to 1.25 Gbps per tunnel with ECMP), failing to meet the 10 Gbps and low latency requirements.

Practice this question →

457

MCQhard

A network engineer is designing a hybrid network with multiple AWS accounts. The company wants to simplify management by using a single AWS Direct Connect connection shared among accounts. Which service should be used to achieve this?

A.Transit Gateway with Direct Connect Gateway

B.VPC Peering

C.AWS PrivateLink

D.AWS VPN CloudHub

AnswerA

Transit Gateway with Direct Connect Gateway allows multi-account sharing of a single Direct Connect connection.

Why this answer

A Transit Gateway with a Direct Connect Gateway allows you to attach multiple VPCs from different AWS accounts to a single Direct Connect connection. The Direct Connect Gateway acts as a bridge between the on-premises network and the Transit Gateway, which then routes traffic to the appropriate VPCs across accounts. This setup simplifies management by centralizing the Direct Connect connection while supporting multi-account architectures.

Exam trap

The trap here is that candidates often confuse Direct Connect Gateway with a simple VIF or assume VPC Peering can provide transitive routing across multiple accounts, but only Transit Gateway with Direct Connect Gateway supports multi-account sharing of a single Direct Connect connection.

How to eliminate wrong answers

Option B is wrong because VPC Peering only connects two VPCs directly and does not support sharing a single Direct Connect connection across multiple accounts; it also lacks transitive routing. Option C is wrong because AWS PrivateLink is used to expose services privately within a VPC or across accounts via interface endpoints, not to share a Direct Connect connection. Option D is wrong because AWS VPN CloudHub is a hub-and-spoke VPN model that uses multiple VPN connections, not a single Direct Connect connection, and does not integrate with Direct Connect Gateway.

Practice this question →

458

MCQmedium

A company is designing a network for a critical application that requires high availability across two AWS Regions (us-east-1 and us-west-2). The application uses an Application Load Balancer (ALB) in each region, with Auto Scaling groups behind them. The database is an Amazon Aurora Global Database with a primary cluster in us-east-1 and a secondary cluster in us-west-2. The company wants to use Amazon Route 53 to route traffic to the closest healthy ALB. They also need to ensure that if the primary database fails over to the secondary region, the application can still write to the database with minimal latency. Additionally, the application must be able to read from the local database in each region for read-intensive workloads. The network team has designed the following: Route 53 with latency-based routing and health checks for the ALBs. The application instances in each region are configured to connect to the local Aurora cluster endpoint. For writes, they use the global writer endpoint. What is the MOST significant design flaw?

A.The Auto Scaling groups are not configured with lifecycle hooks to drain connections during scale-in

B.The Route 53 health checks only monitor the ALB endpoint, not the overall application health including database connectivity

C.The application instances in us-west-2 experience high latency for write operations due to cross-region traffic to the primary database

D.The Aurora Global Database does not support cross-region replication for read replicas

AnswerB

If the database fails in a region, the ALB might still be healthy, causing traffic to be sent to a region that cannot serve requests.

Why this answer

The design flaw is that Route 53 health checks only monitor the ALB endpoint, not the overall application health including database connectivity. If the database in a region fails (e.g., due to a failure in the primary or secondary cluster), the ALB might still be healthy, and Route 53 would continue to route traffic to that region. However, the application instances would not be able to serve requests properly because they rely on the local database.

A robust health check should include checking the application's ability to connect to the database and perform basic operations. This ensures that traffic is only routed to regions where the full application stack is healthy. Other options are less significant: A (lifecycle hooks) is a minor optimization, C (write latency) is inherent to the architecture and might be acceptable for critical writes, and D is false because Aurora Global Database does support cross-region replication.

Practice this question →

459

Multi-Selectmedium

A company is designing a VPC architecture with a public subnet and a private subnet. They want to allow instances in the private subnet to download software updates from the internet. Which TWO options satisfy this requirement? (Choose TWO.)

Select 2 answers

A.Configure a forward proxy in the private subnet and configure the instances to use it.

B.Create a VPC Gateway Endpoint for Amazon S3 and route traffic to it.

C.Set up a NAT Gateway in a public subnet and add a default route in the private subnet route table pointing to the NAT Gateway.

D.Launch a NAT instance in a public subnet and add a default route in the private subnet route table pointing to the NAT instance.

E.Attach an Internet Gateway to the private subnet and add a default route to it.

AnswersC, D

NAT Gateway provides outbound internet access.

Why this answer

A NAT Gateway in a public subnet provides outbound-only internet access to instances in a private subnet. By adding a default route (0.0.0.0/0) in the private subnet route table pointing to the NAT Gateway, traffic from private instances is source-NATed to the NAT Gateway's Elastic IP, allowing downloads while preventing inbound connections from the internet.

Exam trap

AWS often tests the misconception that a NAT Gateway or NAT instance can be placed in a private subnet, but both must reside in a public subnet with an Internet Gateway to translate private IPs to a public IP for outbound internet access.

Practice this question →

460

Multi-Selectmedium

Which THREE AWS services can be used to improve the availability of a web application across multiple AWS Regions? (Choose 3.)

Select 3 answers

A.VPC peering

B.AWS Global Accelerator

C.AWS Direct Connect

D.Amazon CloudFront

E.Amazon Route 53

AnswersB, D, E

Traffic management with health checks.

Why this answer

AWS Global Accelerator improves availability across multiple AWS Regions by using the AWS global network to route user traffic to the optimal regional endpoint based on health, latency, and geography. It provides static anycast IP addresses and automatically reroutes traffic to healthy endpoints during a regional failure, thereby enhancing fault tolerance and performance for global web applications.

Exam trap

AWS often tests the misconception that VPC peering or Direct Connect can provide multi-Region high availability, but these services are designed for private connectivity and do not include any global traffic routing, health monitoring, or automatic failover capabilities.

Practice this question →

461

MCQhard

A company has deployed an application in a VPC with public and private subnets. The application uses an Amazon RDS for MySQL database in a private subnet. To meet security requirements, the database must not be accessible from the internet. The application team needs to connect to the database for maintenance using SSH over a bastion host. Which architecture is the most secure?

A.Bastion host in a public subnet with the same security group as the database, allowing SSH from the corporate IP range and MySQL from the bastion

B.Bastion host in a public subnet with a security group allowing SSH from 0.0.0.0/0, and database security group allowing MySQL from the bastion host's security group

C.Connect to the database directly using a Site-to-Site VPN without a bastion host

D.Bastion host in a public subnet with a security group allowing SSH from the corporate IP range, and database security group allowing MySQL from the bastion host's security group

AnswerD

This is secure and follows best practices.

Why this answer

The most secure architecture because it restricts SSH access to the bastion host from only the corporate IP range, and the database security group allows MySQL (port 3306) traffic solely from the bastion host's security group. This ensures the database is never directly exposed to the internet and only accepts connections from the bastion, which itself is locked down to authorized corporate IPs. The use of security group referencing (instead of IP-based rules) provides dynamic, scalable access control that automatically applies to any instances with the bastion's security group.

Exam trap

The trap here is that candidates often confuse security group referencing with IP-based rules, or they mistakenly think that allowing SSH from 0.0.0.0/0 is acceptable because the bastion host is the only entry point, ignoring the increased attack surface and the principle of least privilege.

How to eliminate wrong answers

Option A is wrong because placing the bastion host in the same security group as the database would allow the database to inherit the bastion's SSH rule, potentially exposing the database to SSH traffic from the corporate IP range, which violates the requirement that the database not be accessible from the internet. Option B is wrong because allowing SSH from 0.0.0.0/0 exposes the bastion host to brute-force attacks from any internet source, significantly reducing security. Option C is wrong because connecting directly to the database via Site-to-Site VPN without a bastion host still exposes the database to the corporate network, and if the VPN is compromised, the database is directly accessible; a bastion host provides an additional layer of authentication and audit logging.

Practice this question →

462

MCQmedium

A company has a VPC with a CIDR of 172.16.0.0/16. They have a subnet 172.16.1.0/24 for web servers and another subnet 172.16.2.0/24 for database servers. The web servers need to access the database servers on port 3306. Which configuration is required?

A.Configure network ACLs to allow inbound on port 3306 from web subnet.

B.Web SG: inbound from 0.0.0.0/0 on port 3306. DB SG: outbound to web SG on port 3306.

C.Web SG: outbound to DB SG on port 3306. DB SG: inbound from web SG on port 3306.

D.Web SG: outbound to DB SG on all ports. DB SG: inbound from web SG on all ports.

AnswerC

Allows only MySQL traffic from web to DB.

Why this answer

Security groups are stateful and control traffic at the instance level. The web server security group needs an outbound rule allowing traffic to the database security group on port 3306, and the database security group needs an inbound rule allowing traffic from the web security group on port 3306. This ensures that only the web servers can initiate connections to the database servers on the required port.

Exam trap

The trap here is that candidates often confuse the stateless nature of network ACLs with the stateful behavior of security groups, or they incorrectly assume that inbound rules on the source security group are needed instead of outbound rules on the source and inbound rules on the destination.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and apply at the subnet level, not the instance level, and they require both inbound and outbound rules to allow traffic; additionally, the question asks for a configuration that works with security groups, not network ACLs. Option B is wrong because it incorrectly sets the web security group to allow inbound traffic on port 3306 from 0.0.0.0/0, which would allow any source to connect to the web servers on the database port, and the outbound rule on the database security group is unnecessary because security groups are stateful and return traffic is automatically allowed. Option D is wrong because it allows all ports instead of restricting to port 3306, violating the principle of least privilege and unnecessarily exposing the database servers to all traffic from the web servers.

Practice this question →

463

MCQeasy

A company wants to connect its on-premises data center to AWS using a dedicated, high-bandwidth, low-latency connection. The data center is collocated with an AWS Direct Connect location. Which AWS service should be used to establish this connection?

A.VPC peering

B.AWS Transit Gateway

C.AWS Direct Connect

D.AWS Site-to-Site VPN

AnswerC

Direct Connect provides a dedicated, private connection with high bandwidth and low latency.

Why this answer

AWS Direct Connect is the correct service because it provides a dedicated, private, high-bandwidth, low-latency connection from an on-premises data center to AWS. Since the data center is collocated with an AWS Direct Connect location, the company can establish a physical cross-connect directly to the AWS Direct Connect router, bypassing the public internet entirely.

Exam trap

The ANS-C01 exam often tests the distinction between the physical connectivity service (Direct Connect) and the logical aggregation service (Transit Gateway), leading candidates to mistakenly choose Transit Gateway when the question explicitly asks for the service that establishes the dedicated connection.

How to eliminate wrong answers

Option A is wrong because VPC peering connects two VPCs within AWS, not an on-premises data center to AWS. Option B is wrong because AWS Transit Gateway is a network transit hub that connects VPCs and on-premises networks, but it does not provide the physical dedicated connection itself; it requires an underlying connection like Direct Connect or VPN. Option D is wrong because AWS Site-to-Site VPN uses the public internet and IPSec tunnels, which cannot guarantee the dedicated high-bandwidth and low-latency requirements specified in the question.

Practice this question →

464

Multi-Selectmedium

A company is designing a multi-region active-active application. They need to ensure that traffic is routed to the closest healthy region and that failover happens automatically. Which TWO services should be used together to achieve this?

Select 2 answers

A.AWS Transit Gateway with inter-region peering

B.Amazon CloudFront with multiple origins

C.AWS Global Accelerator with endpoint groups

D.Amazon Route 53 with latency-based routing

E.AWS Direct Connect with multiple locations

AnswersC, D

Provides anycast IPs and health checks.

Why this answer

AWS Global Accelerator (C) uses Anycast IPs to direct traffic to the closest healthy endpoint group, automatically rerouting traffic if a region becomes unhealthy. This provides fast regional failover and low-latency routing without DNS caching delays, making it ideal for active-active multi-region applications.

Exam trap

The trap here is that candidates often think Route 53 latency-based routing (D) alone is sufficient for automatic failover, but it relies on DNS caching and TTLs, which can delay failover by minutes, whereas Global Accelerator provides sub-second failover and is the recommended service for active-active multi-region traffic steering.

Practice this question →

465

MCQhard

A company is designing a network architecture for a critical application that requires sub-millisecond latency between EC2 instances in the same placement group. The instances will be launched in a single Availability Zone in us-east-1. Which combination of features should be used to achieve the lowest latency?

A.Launch instances in a cluster placement group with Enhanced Networking (ENA) enabled.

B.Launch instances in a spread placement group with SR-IOV enabled.

C.Launch instances in a spread placement group with Enhanced Networking (ENA) enabled.

D.Launch instances in a cluster placement group with Elastic Fabric Adapter (EFA) enabled.

AnswerD

Cluster placement group minimizes network distance, and EFA provides OS-bypass for low latency.

Why this answer

Elastic Fabric Adapter (EFA) provides OS-bypass capabilities that enable HPC and machine learning workloads to achieve sub-millisecond latency by bypassing the operating system kernel for inter-instance communication. Combined with a cluster placement group, which ensures instances are in close physical proximity within a single Availability Zone, this configuration delivers the lowest possible latency for tightly coupled applications.

Exam trap

The trap here is that candidates often assume Enhanced Networking (ENA) is the best option for low latency because it is widely used for high-throughput workloads, but they overlook that EFA's OS-bypass is specifically designed for sub-millisecond latency in tightly coupled HPC applications.

How to eliminate wrong answers

Option A is wrong because while Enhanced Networking (ENA) improves throughput and reduces latency compared to legacy networking, it still requires the OS kernel to process network packets, which introduces higher latency than the OS-bypass mechanism of EFA. Option B is wrong because spread placement groups are designed to maximize availability by placing instances on distinct hardware, which increases physical distance and latency, and SR-IOV is a generic term for direct I/O virtualization, not a specific AWS feature like ENA or EFA. Option C is wrong because spread placement groups are unsuitable for low-latency clustering due to hardware separation, and ENA alone cannot achieve sub-millisecond latency as it does not provide OS-bypass.

Practice this question →

466

MCQhard

A network engineer is setting up a cross-account Route 53 Resolver rule association. The engineer creates the above resource-based policy on a resolver rule in account 111111111111. The engineer then tries to associate the rule from account 222222222222 but receives an access denied error. What is the MOST likely reason for the failure?

A.The policy does not allow the 'route53resolver:AssociateResolverRule' action.

B.The policy does not include the 'route53resolver:DisassociateResolverRule' action.

C.The policy's Principal is set to account 111111111111 instead of account 222222222222.

D.The resolver rule is not shared with account 222222222222.

AnswerC

The principal should be the account that will use the rule.

Why this answer

The resource-based policy on the Route 53 Resolver rule must specify the consuming account (222222222222) as the Principal to authorize cross-account association. Since the policy incorrectly sets the Principal to the owning account (111111111111), the request from account 222222222222 lacks the required permissions, resulting in an access denied error.

Exam trap

AWS often tests the distinction between the resource-based policy's Principal field and the Action field, tricking candidates into thinking a missing action is the cause when the real issue is an incorrect principal account ID.

How to eliminate wrong answers

Option A is wrong because the policy does include the 'route53resolver:AssociateResolverRule' action (as shown in the policy snippet), so the failure is not due to a missing action. Option B is wrong because the 'DisassociateResolverRule' action is irrelevant for associating a rule; the error occurs during association, not disassociation. Option D is wrong because the policy itself is the mechanism for sharing; if the policy were correctly configured, the rule would be shared, but the error stems from an incorrect Principal, not from a lack of sharing.

Practice this question →

467

MCQeasy

A startup is launching a new web application on AWS and needs to design a highly available and secure network architecture. The application will run on EC2 instances in an Auto Scaling group across two Availability Zones in a single region. The application must be accessible from the internet over HTTPS. The company expects variable traffic and wants to reduce costs where possible. They also need to protect against common web exploits like SQL injection and cross-site scripting. Which combination of AWS services should be used for the network design?

A.Use an Application Load Balancer (ALB) in private subnets. Enable AWS WAF on the ALB. Place EC2 instances in public subnets with a VPC endpoint for outbound traffic.

B.Use an Application Load Balancer (ALB) in public subnets. Enable AWS WAF on the ALB. Place EC2 instances in private subnets with a NAT gateway for outbound traffic.

C.Use an Application Load Balancer (ALB) in public subnets. Use a VPC endpoint for outbound traffic. Place EC2 instances in public subnets with Elastic IPs.

D.Use a Network Load Balancer (NLB) in public subnets. Enable AWS Shield Advanced for DDoS protection. Place EC2 instances in private subnets with a NAT gateway for outbound traffic.

AnswerB

ALB provides HTTP/HTTPS termination, integrates with WAF for web exploit protection, and supports private subnet instances.

Why this answer

An Application Load Balancer (ALB) in public subnets can terminate HTTPS and distribute traffic to EC2 instances in private subnets, which enhances security by removing direct internet access from the instances. Enabling AWS WAF on the ALB protects against common web exploits like SQL injection and cross-site scripting. A NAT gateway in public subnets provides outbound internet access for instances in private subnets, which is cost-effective for variable traffic as it scales automatically and incurs charges only when used.

Exam trap

The trap here is that candidates often confuse the placement of load balancers and instances, mistakenly thinking that placing the ALB in private subnets is acceptable or that a VPC endpoint can replace a NAT gateway for general outbound internet access.

How to eliminate wrong answers

Option A is wrong because placing the ALB in private subnets would prevent it from receiving internet traffic directly, as private subnets lack a route to an internet gateway; also, placing EC2 instances in public subnets with a VPC endpoint for outbound traffic is incorrect because VPC endpoints are used for private connectivity to AWS services, not for general internet outbound traffic. Option C is wrong because placing EC2 instances in public subnets with Elastic IPs exposes them directly to the internet, bypassing the security and load-balancing benefits of the ALB, and using a VPC endpoint for outbound traffic does not provide general internet access. Option D is wrong because a Network Load Balancer (NLB) operates at Layer 4 and cannot inspect application-layer traffic, so it cannot be integrated with AWS WAF for web exploit protection; AWS Shield Advanced is overkill for basic DDoS protection and adds unnecessary cost for a startup with variable traffic.

Practice this question →

468

Multi-Selectmedium

A company is designing a multi-region active-active application using Amazon Route 53 and Application Load Balancers (ALBs). The application must be highly available and route traffic to the closest healthy endpoint. Which TWO configurations should the company use? (Choose two.)

Select 2 answers

A.Configure Route 53 with failover routing

B.Configure Route 53 with latency-based routing

C.Associate health checks with each Route 53 record

D.Configure Route 53 with weighted routing

E.Configure Route 53 with geoproximity routing

AnswersB, C

Latency-based routing sends traffic to the region with the lowest latency, supporting active-active and health checks.

Why this answer

Latency-based routing (Option B) directs traffic to the AWS region that provides the lowest latency for each user, which aligns with the requirement to route to the closest healthy endpoint. Health checks (Option C) must be associated with each Route 53 record to mark endpoints as healthy or unhealthy, ensuring traffic is only sent to available ALBs. Together, these configurations enable an active-active multi-region design with automatic failover to the next-lowest-latency healthy region.

Exam trap

The trap here is that candidates often confuse latency-based routing with geoproximity routing, assuming geoproximity uses IP geolocation for closest endpoint routing, but latency-based routing is the correct service for dynamic proximity based on actual network performance, not static geographic boundaries.

Practice this question →

469

MCQhard

A company has a multi-VPC architecture connected via AWS Transit Gateway. They have VPCs in different AWS accounts. The network team wants to centralize internet traffic through a single egress VPC that has a NAT Gateway and an Internet Gateway. All other VPCs should route outbound internet traffic through the Transit Gateway to the egress VPC. They have configured route tables accordingly, but instances in non-egress VPCs cannot reach the internet. What is the most likely missing configuration?

A.The Transit Gateway route table does not have a route to the non-egress VPC attachments for the return traffic.

B.The security group for the NAT Gateway in the egress VPC is blocking inbound traffic from other VPCs.

C.The egress VPC's route table does not have a route to the Transit Gateway for the return traffic from the internet.

D.The non-egress VPCs are using VPC endpoints instead of the Transit Gateway for internet access.

AnswerA

For return traffic from the egress VPC to reach the non-egress VPCs, the TGW route table must have routes to those attachments.

Why this answer

For traffic from non-egress VPCs to reach the internet, the Transit Gateway must have a route table that includes a route to the non-egress VPC attachments for the return traffic. Without this route, return traffic from the internet (via the egress VPC's NAT Gateway) cannot be forwarded back to the originating VPC through the Transit Gateway. The other options are incorrect: B is false because security groups are stateful, so inbound rules do not affect return traffic; C is false because the egress VPC needs a route to the Transit Gateway for outbound traffic, not return traffic; D is false because VPC endpoints are not used for general internet access.

Practice this question →

470

MCQeasy

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add additional IP address space for new subnets. The existing subnets use 10.0.0.0/17 and 10.0.128.0/17. Which CIDR block should be added as a secondary CIDR to the VPC to provide the most additional contiguous address space?

A.10.1.0.0/16

B.10.0.0.0/0

C.10.0.0.0/8

D.10.0.0.0/16

AnswerA

This is a non-overlapping /16 block contiguous to the existing /16, providing additional address space.

Why this answer

(10.1.0.0/16) is correct because the VPC already uses the entire 10.0.0.0/16 range (split into 10.0.0.0/17 and 10.0.128.0/17). To add contiguous address space, you must use a different /16 block that is adjacent in the private IPv4 address space, such as 10.1.0.0/16. AWS VPCs support secondary CIDRs that must not overlap with existing CIDRs, and 10.1.0.0/16 provides a non-overlapping, contiguous block.

Exam trap

The trap here is that candidates mistakenly think they can reuse part of the same /16 block (like 10.0.0.0/16 again) or use a larger block like /8, but AWS requires secondary CIDRs to be non-overlapping and within the /16 maximum for a single VPC.

How to eliminate wrong answers

Option B (10.0.0.0/0) is wrong because it is not a valid CIDR block for a VPC; a /0 prefix length is too large and would overlap with all IP addresses, which is not allowed by AWS. Option C (10.0.0.0/8) is wrong because it overlaps with the existing 10.0.0.0/16 CIDR and is too large (a /8 block exceeds the maximum VPC size of /16 for a secondary CIDR in most cases). Option D (10.0.0.0/16) is wrong because it is identical to the primary CIDR and would cause an overlap, which AWS does not permit.

Practice this question →

471

MCQhard

A company is expanding its on-premises data center to AWS using a hybrid cloud architecture. They have established an AWS Direct Connect connection with a private virtual interface to a VPC. The on-premises network uses BGP to exchange routes with the VPC. The network engineer notices that the on-premises network can reach some EC2 instances in the VPC but not others. All EC2 instances are in the same subnet (10.0.1.0/24) and have private IP addresses. The Direct Connect virtual interface is configured with the VPC CIDR (10.0.0.0/16) advertised to on-premises. The on-premises firewall logs show that traffic to the unreachable instances is being dropped. What is the most likely cause?

A.The subnet route table does not have a route to the on-premises network.

B.The BGP session is not advertising the on-premises routes to the VPC.

C.The network ACL on the subnet is blocking inbound traffic from on-premises.

D.The security group attached to the unreachable instances is not allowing inbound traffic from the on-premises network.

AnswerD

Correct: Security groups can be different per instance, causing inconsistent reachability.

Why this answer

Security groups are stateful and control inbound traffic; if the security group does not allow inbound traffic from on-premises, it will be dropped. Option A is wrong because the subnet route table has a route to the virtual private gateway, which is correct. Option B is wrong because the VPC CIDR is advertised.

Option C is wrong because network ACLs are stateless and need both inbound and outbound rules; but if they were misconfigured, all instances would be affected.

Practice this question →

472

MCQeasy

A company is designing a VPC for a three-tier web application. The web servers must be accessible from the internet, while the application and database servers must be isolated. Which subnet design should the company use?

A.A single subnet for all tiers with network ACLs to isolate traffic

B.Public subnet for web servers, private subnets for application and database servers

C.Private subnets for all tiers

D.Public subnets for all tiers

AnswerB

Provides internet access to web servers while isolating backend tiers.

Why this answer

It uses a public subnet with an Internet Gateway (IGW) for the web servers to receive inbound traffic from the internet, while placing the application and database servers in private subnets with no direct internet route. This design enforces the principle of least privilege by isolating sensitive tiers, using NAT Gateway or VPC endpoints for outbound traffic if needed, and relying on security groups and network ACLs for fine-grained access control.

Exam trap

The trap here is that candidates often confuse network ACLs with security groups, thinking ACLs alone can isolate traffic within a single subnet, but ACLs cannot prevent instances in the same subnet from communicating with each other unless explicit deny rules are added, and they cannot replace the architectural separation of public and private subnets required for internet-facing vs. internal tiers.

How to eliminate wrong answers

Option A is wrong because a single subnet for all tiers, even with network ACLs, cannot provide true isolation—network ACLs are stateless and apply to the entire subnet, so any instance in that subnet can potentially be reached from the internet if the route table includes an IGW, violating the requirement to isolate application and database servers. Option C is wrong because private subnets for all tiers would prevent the web servers from being directly accessible from the internet, as private subnets have no route to an IGW, breaking the requirement for internet-facing web servers. Option D is wrong because public subnets for all tiers would expose the application and database servers directly to the internet, creating a severe security risk and violating the isolation requirement.

Practice this question →

473

MCQmedium

A company is deploying a new application on AWS and needs a highly available architecture across two Availability Zones (AZs) in a single region. The application consists of an Application Load Balancer (ALB) in front of a fleet of EC2 instances running in an Auto Scaling group, and an Amazon RDS for MySQL database with Multi-AZ deployment. The company requires that the application remain available even if an entire AZ fails. The network team has designed the VPC with two public subnets and two private subnets, each in a different AZ. The ALB is internet-facing and placed in the public subnets. The EC2 instances are in the private subnets. The RDS instance is also in the private subnets. The route tables are configured with a default route via an Internet Gateway for public subnets and via a NAT Gateway for private subnets. What change is MOST likely needed to ensure the architecture can survive an AZ failure?

A.Add a second Internet Gateway in the other AZ

B.Use a Network Load Balancer instead of an Application Load Balancer

C.Create a NAT Gateway in each Availability Zone

D.Configure the Auto Scaling group to launch instances in both AZs

AnswerC

A NAT Gateway per AZ ensures outbound connectivity survives an AZ failure.

Why this answer

To survive an AZ failure, each AZ must have its own NAT Gateway to provide outbound internet access for instances in that AZ. If only one NAT Gateway is used and its AZ fails, instances in the other AZ lose internet connectivity. The architecture already has the ALB in public subnets across both AZs and RDS Multi-AZ, so the missing component is a NAT Gateway per AZ.

Option A is incorrect because you cannot have an Internet Gateway per AZ; it is a regional resource. Option B is incorrect because an NLB is not needed; the ALB already provides load balancing. Option D is incorrect because the Auto Scaling group should already be configured to launch instances in both AZs; that's a prerequisite, not the most likely missing change.

Practice this question →

474

Multi-Selecthard

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. It needs to connect to two other VPCs: VPC B (10.1.0.0/16) and VPC C (10.2.0.0/16). The company wants to use AWS Transit Gateway. Which THREE configurations are required to enable full mesh connectivity between all three VPCs?

Select 3 answers

A.Create separate Transit Gateway route tables for each VPC to isolate traffic.

B.Create a VPN attachment to each VPC for encrypted communication.

C.Associate each VPC attachment with the Transit Gateway route table.

D.Create a Transit Gateway and attach each VPC to it.

E.Create a Transit Gateway route table and add static routes for each VPC CIDR pointing to the respective attachment.

AnswersC, D, E

Association allows the VPC to use the route table.

Why this answer

Associating each VPC attachment with the Transit Gateway route table is necessary for the Transit Gateway to know which attachments can communicate. Without this association, the Transit Gateway would not forward traffic between the VPCs, even if routes are present in the route table.

Exam trap

The trap here is that candidates often think separate route tables are needed for isolation (Option A) or that VPN attachments are required for security (Option B), but full mesh connectivity simply requires a single Transit Gateway route table with routes pointing to each VPC attachment and all attachments associated with that route table.

Practice this question →

475

MCQmedium

A company is designing a hybrid network architecture that requires high availability and low latency between its on-premises data center and AWS. The company currently has two Direct Connect connections from different providers terminating at two different AWS Direct Connect locations. Which solution provides the most resilient and high-performance connectivity?

A.Use a single Direct Connect connection with multiple VLANs.

B.Use two Direct Connect connections from different providers at different locations with a VPN backup.

C.Use Site-to-Site VPN over the internet as the primary connection.

D.Use two Direct Connect connections from the same provider at the same location.

AnswerB

Provides diverse paths and high availability.

Why this answer

Using two Direct Connect connections from different providers at different locations ensures physical and provider diversity, eliminating single points of failure. Adding a VPN backup provides an additional failover path over the internet, which is essential for maintaining connectivity if both Direct Connect links fail. This design meets the requirements for high availability and low latency by leveraging active/active or active/passive traffic engineering with BGP routing and AS path prepending.

Exam trap

AWS often tests the misconception that multiple connections from the same provider or location are sufficient for high availability, but the trap here is that true resilience requires both provider and location diversity to protect against provider-specific outages and location-level disasters.

How to eliminate wrong answers

Option A is wrong because a single Direct Connect connection with multiple VLANs does not provide any physical or provider diversity; a single failure (e.g., fiber cut or provider outage) would take down all VLANs, violating high availability. Option C is wrong because a Site-to-Site VPN over the internet typically introduces higher latency and jitter compared to Direct Connect, and it lacks the consistent performance and SLA guarantees of dedicated connections, making it unsuitable as a primary low-latency solution. Option D is wrong because using two Direct Connect connections from the same provider at the same location creates a single point of failure at the provider level and the location level; a provider outage or location-wide event (e.g., power failure) would impact both connections, failing the resilience requirement.

Practice this question →

476

Multi-Selectmedium

A company wants to connect multiple VPCs in different AWS Regions using AWS Transit Gateway. The company requires full mesh connectivity with centralized inspection of inter-Region traffic. Which TWO actions should the company take? (Choose TWO.)

Select 2 answers

A.Create Transit Gateway peering attachments between the Transit Gateways in each Region.

B.Create VPN attachments between each Transit Gateway and the inspection VPC.

C.Use VPC peering connections between VPCs in different Regions.

D.Route traffic through a central inspection VPC in one Region using Transit Gateway route tables.

E.Disable cross-Region peering on the Transit Gateway.

AnswersA, D

Peering attachments enable inter-Region connectivity.

Why this answer

AWS Transit Gateway supports inter-Region peering attachments, which allow you to connect Transit Gateways in different Regions and route traffic between them using the AWS global network. Option D is correct because you can centralize traffic inspection by routing inter-Region traffic through a dedicated inspection VPC attached to one Transit Gateway, using separate route tables to force traffic through that VPC before forwarding it to the destination Region.

Exam trap

The trap here is that candidates often confuse Transit Gateway peering with VPC peering, assuming VPC peering can provide transitive routing across multiple VPCs, or they mistakenly think VPN attachments are required for centralized inspection instead of using route tables and attachments.

Practice this question →

477

MCQmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download updates from the internet. The company wants to minimize costs and avoid exposing the instance to inbound internet traffic. Which solution should the engineer choose?

A.Deploy a NAT instance in the private subnet and route traffic through it.

B.Deploy a NAT Gateway in the public subnet and add a route in the private subnet route table pointing to the NAT Gateway.

C.Configure a forward proxy on the EC2 instance itself.

D.Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet's route table.

AnswerB

NAT Gateway provides outbound internet access, cost-effective and managed.

Why this answer

A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound connections to the internet (e.g., for updates) while remaining unreachable from inbound internet traffic. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, which then uses the Internet Gateway for outbound traffic. This is the most cost-effective and fully managed solution compared to a NAT instance, as it avoids per-instance management and scales automatically.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT instance can be placed in a private subnet, but in reality, it must reside in a public subnet with a route to an Internet Gateway to perform its function.

How to eliminate wrong answers

Option A is wrong because a NAT instance must be deployed in a public subnet (not a private subnet) to have a route to the Internet Gateway; placing it in a private subnet would prevent it from reaching the internet. Option C is wrong because configuring a forward proxy on the EC2 instance itself does not solve the routing problem—the instance still needs a path to the internet, and a proxy alone does not provide NAT or a default gateway. Option D is wrong because adding a route to the Internet Gateway in the private subnet's route table would directly expose the private instance to inbound internet traffic (since the Internet Gateway allows bidirectional traffic), violating the requirement to avoid inbound exposure.

Practice this question →

478

MCQeasy

A company is designing a network for a three-tier web application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. All tiers must be in private subnets except the web tier. Which combination of AWS services and routing should be used to meet these requirements?

A.Use a NAT gateway in the public subnet for web tier, and route all traffic through it.

B.Use a VPN connection to the internet gateway and route traffic through a virtual private gateway.

C.Use an internet gateway, public subnet for web tier, private subnets for app and database, and network ACLs to filter traffic between tiers.

D.Use an internet gateway attached to the VPC, public subnet for web tier, private subnets for app and database tiers, and security groups to restrict traffic between tiers.

AnswerD

This standard architecture meets all requirements.

Why this answer

It uses an internet gateway attached to the VPC to provide internet access to the web tier in a public subnet, while the application and database tiers are placed in private subnets. Security groups are stateful and can restrict traffic between tiers by allowing inbound traffic only from the specific security group of the preceding tier (e.g., app tier SG allows traffic only from web tier SG), which meets the requirement without exposing private tiers to the internet. Network ACLs are stateless and less suitable for this granular, stateful filtering between tiers.

Exam trap

The ANS-C01 exam often tests the distinction between stateful security groups and stateless network ACLs, and the trap here is that candidates mistakenly choose network ACLs (Option C) because they think ACLs are the only way to filter traffic between subnets, overlooking that security groups can be applied to instances in private subnets and referenced by other security groups for cross-tier filtering.

How to eliminate wrong answers

Option A is wrong because a NAT gateway is used to allow outbound internet access from private subnets, not to provide inbound internet access to a web tier; it does not make the web tier accessible from the internet. Option B is wrong because a VPN connection and virtual private gateway are used for site-to-site VPN connectivity to an on-premises network, not for direct internet access; this would not allow the web tier to be publicly accessible from the internet. Option C is wrong because network ACLs are stateless and require explicit rules for both inbound and outbound traffic, making them more complex and error-prone for controlling traffic between tiers; security groups are the recommended stateful mechanism for such fine-grained, tier-to-tier access control.

Practice this question →

479

Multi-Selecteasy

Which TWO AWS services can be used to provide inbound internet connectivity to resources in a VPC? (Select TWO.)

Select 2 answers

A.VPC Endpoint

B.Internet Gateway

C.Elastic Load Balancer (internet-facing)

D.Amazon CloudFront

E.NAT Gateway

AnswersB, C

Direct inbound access.

Why this answer

An Internet Gateway (IGW) is a horizontally scaled, redundant VPC component that provides a target in VPC route tables for internet-routable traffic and performs network address translation (NAT) for instances with public IPs. It enables inbound internet connectivity by allowing traffic from the internet to reach resources in the VPC, provided the resources have public IPs and the route table directs 0.0.0.0/0 traffic to the IGW.

Exam trap

The trap here is that candidates often confuse NAT Gateway with providing inbound internet access, but NAT Gateway is strictly one-way (outbound only) and cannot initiate or forward unsolicited inbound connections from the internet.

Practice this question →

480

MCQmedium

A company has a VPC with multiple subnets across two Availability Zones. They are designing a highly available web application using an Application Load Balancer (ALB) and EC2 instances in an Auto Scaling group. Which of the following is the most resilient and cost-effective design for the network layer?

A.Deploy a Network Load Balancer (NLB) in each AZ and associate them with a single ALB.

B.Deploy an ALB in one AZ and EC2 instances in the same AZ.

C.Deploy a single ALB with subnets in two AZs and enable cross-zone load balancing.

D.Deploy an ALB in each AZ and use Route 53 weighted routing.

AnswerC

Cross-zone balancing ensures traffic is distributed across instances in all AZs.

Why this answer

Deploying a single Application Load Balancer (ALB) with subnets in two Availability Zones (AZs) and enabling cross-zone load balancing provides high availability and fault tolerance at the network layer. The ALB automatically distributes incoming traffic across healthy targets in all enabled AZs, eliminating the need for multiple load balancers and reducing costs while maintaining resilience. This design leverages the ALB's native ability to handle AZ failures by routing traffic only to healthy AZs, making it both resilient and cost-effective.

Exam trap

The trap here is that candidates often assume deploying a load balancer in each AZ (Option D) is necessary for high availability, but they overlook that a single ALB with subnets in multiple AZs and cross-zone load balancing already provides full AZ-level redundancy at lower cost and complexity.

How to eliminate wrong answers

Option A is wrong because deploying a Network Load Balancer (NLB) in each AZ and associating them with a single ALB introduces unnecessary complexity and cost; the ALB already supports multi-AZ deployments natively, and the NLB at Layer 4 does not provide application-layer features like path-based routing or host-based routing that the ALB offers, making this design redundant and more expensive. Option B is wrong because deploying an ALB and EC2 instances in a single AZ creates a single point of failure; if that AZ goes down, the entire application becomes unavailable, violating the high availability requirement. Option D is wrong because deploying an ALB in each AZ and using Route 53 weighted routing is overly complex and costly; Route 53 weighted routing does not provide automatic health-based failover between ALBs, and each ALB incurs separate hourly and data processing charges, making this design less resilient and more expensive than a single ALB with cross-zone load balancing.

Practice this question →

481

MCQhard

A company is using AWS CloudFormation to deploy a VPC with public and private subnets across multiple Availability Zones. The template includes a NAT gateway in each public subnet. The company wants to ensure that the private subnet route tables automatically update when the NAT gateway ID changes. Which feature should be used?

A.Use the 'DependsOn' attribute to ensure the route is created after the NAT gateway.

B.Use the 'AWS::EC2::Route' resource with a 'GatewayId' property that references the NAT gateway using 'Ref'.

C.Use the 'Fn::GetAtt' intrinsic function to retrieve the NAT gateway ID and pass it to the route.

D.Use an AWS Lambda custom resource to update the route table when the NAT gateway changes.

AnswerC

Fn::GetAtt can retrieve the physical ID of the NAT gateway, and if the NAT gateway is replaced, CloudFormation updates the route automatically.

Why this answer

The `Fn::GetAtt` intrinsic function can retrieve the NAT gateway ID (e.g., `Fn::GetAtt: [NatGateway, NatGatewayId]`) and pass it as the `GatewayId` property of an `AWS::EC2::Route` resource. This ensures that when the NAT gateway is replaced (e.g., due to an update or failure), the route automatically updates to reference the new NAT gateway ID, maintaining connectivity for private subnets without manual intervention.

Exam trap

The trap here is that candidates confuse `Ref` (which returns the logical resource name or a default attribute like the AZ) with `Fn::GetAtt` (which returns a specific physical attribute like the NAT gateway ID), leading them to choose Option B incorrectly.

How to eliminate wrong answers

Option A is wrong because the `DependsOn` attribute only controls the order of resource creation, not the dynamic resolution of the NAT gateway ID; it does not cause the route to update when the NAT gateway ID changes. Option B is wrong because the `AWS::EC2::Route` resource does not have a `GatewayId` property; it uses `NatGatewayId` for NAT gateway routes, and using `Ref` on a NAT gateway returns its logical name, not the physical ID, so the route would not automatically update on replacement. Option D is wrong because using an AWS Lambda custom resource is unnecessarily complex and introduces custom code and potential failure points; CloudFormation's built-in `Fn::GetAtt` already provides the required dynamic reference without additional resources.

Practice this question →

482

Multi-Selecthard

A company has a VPC with public and private subnets. They want to implement a bastion host to allow secure SSH access to instances in private subnets. Which TWO components are required for this design?

Select 2 answers

A.A bastion host deployed in a public subnet

B.A NAT gateway in the public subnet

C.An Internet Gateway attached to the VPC

D.Security group rules allowing SSH from the bastion to private instances

E.A Site-to-Site VPN connection to the VPC

AnswersA, D

Bastion must be publicly accessible.

Why this answer

A bastion host must be deployed in a public subnet because it needs direct internet access via an Internet Gateway (IGW) to allow administrators to initiate SSH connections from the internet. The bastion then acts as a jump box, forwarding SSH traffic to private instances. Security group rules on the private instances must explicitly allow inbound SSH (TCP port 22) from the bastion host's private IP or security group, ensuring that only the bastion can reach them, not the internet directly.

Exam trap

AWS often tests the misconception that a NAT gateway is required for inbound SSH access to private instances, when in fact it only provides outbound internet access and cannot initiate inbound connections from the internet.

Practice this question →