Courseiva

CCNA Network Implementation Questions

75 of 416 questions · Page 2/6 · Network Implementation · Answers revealed

Practice these questionsDomain overviewAll questions
76
Multi-Selectmedium

Which THREE of the following are valid configurations for an AWS Direct Connect virtual interface? (Choose three.)

Select 3 answers
A.VPN virtual interface
B.Private virtual interface
C.Hosted virtual interface
D.Transit virtual interface
E.Public virtual interface
AnswersB, D, E

Correct: A private virtual interface is a valid type for connecting to a VPC using private IP addresses.

Why this answer

AWS Direct Connect supports three types of virtual interfaces: private, public, and transit. A private virtual interface (B) connects your on-premises network to an Amazon VPC using private IP addresses. A public virtual interface (E) provides access to AWS public services (e.g., S3, DynamoDB) over the Direct Connect link.

A transit virtual interface (D) enables connectivity from a Direct Connect gateway to one or more transit gateways, allowing access to multiple VPCs and VPN connections. All three are valid configurations.

Exam trap

AWS often tests the distinction between the three valid virtual interface types (private, public, transit) and tricks candidates by including 'VPN virtual interface' or 'Hosted virtual interface' as plausible-sounding options, exploiting confusion about how VPNs and partner-provisioned connections relate to Direct Connect.

Practice this question →
77
MCQeasy

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets are used for NAT gateways and an Application Load Balancer (ALB). The private subnets host EC2 instances running a web application. What is the most cost-effective and highly available configuration for internet access from the private instances?

A.Deploy a NAT gateway in each public subnet and configure private route tables with a default route to the NAT gateway in the same AZ.
B.Create a single NAT gateway in one public subnet and route all private traffic to it.
C.Attach an internet gateway to the VPC and add a default route to it in the private subnets.
D.Launch a NAT instance in each public subnet and configure the private route tables.
AnswerA

Provides high availability (each AZ independent) and uses managed service, cost-effective for moderate traffic.

Why this answer

Deploying a NAT gateway in each public subnet (one per Availability Zone) ensures that private instances in each AZ can route outbound traffic through a NAT gateway in the same AZ, providing both high availability (no single point of failure) and cost efficiency (no cross-AZ data transfer charges). This configuration uses the default route (0.0.0.0/0) in the private route tables pointing to the NAT gateway in the same AZ, which avoids the per-GB data transfer costs that would occur if traffic crossed AZs to reach a single NAT gateway.

Exam trap

The ANS-C01 exam often tests the misconception that a single NAT gateway is sufficient for high availability, but the trap here is that a single NAT gateway is a single point of failure and incurs cross-AZ data transfer costs, making per-AZ NAT gateways the correct cost-effective and highly available design.

How to eliminate wrong answers

Option B is wrong because a single NAT gateway in one AZ creates a single point of failure and incurs cross-AZ data transfer costs for private instances in other AZs, reducing both availability and cost-effectiveness. Option C is wrong because attaching an internet gateway directly to private subnets would expose the private EC2 instances to the internet, bypassing NAT and violating security best practices; private subnets must not have a default route to an internet gateway. Option D is wrong because NAT instances are less cost-effective and less reliable than NAT gateways; they require manual scaling, patching, and high-availability management, and they have limited bandwidth compared to the managed NAT gateway service.

Practice this question →
78
MCQmedium

A company has a Direct Connect connection with a private virtual interface to a VPC. They want to use the same Direct Connect connection to access another VPC in the same region. Which solution should they implement?

A.Create a second private virtual interface to the second VPC.
B.Set up a Site-to-Site VPN over the Direct Connect connection to the second VPC.
C.Use a Transit Gateway and a transit virtual interface.
D.Order a second Direct Connect connection.
AnswerC

Transit VIF connects to TGW, which can attach to multiple VPCs.

Why this answer

A Transit Gateway (TGW) allows you to attach multiple VPCs and a Direct Connect Gateway (DXGW) via a transit virtual interface (VIF). This enables a single Direct Connect connection to route traffic to multiple VPCs in the same region without additional physical connections or private VIFs. The TGW acts as a central hub, simplifying network architecture and reducing operational overhead.

Exam trap

The ANS-C01 exam often tests the misconception that a private virtual interface can be shared across multiple VPCs directly, but the correct approach requires a Transit Gateway and a transit virtual interface to aggregate connectivity.

How to eliminate wrong answers

Option A is wrong because a private virtual interface is a Layer 2 connection that can only be associated with a single VPC (or a single Direct Connect Gateway); creating a second private VIF on the same Direct Connect connection would require a separate VLAN and is not supported for multiple VPCs without a Transit Gateway. Option B is wrong because a Site-to-Site VPN over Direct Connect is unnecessary and inefficient; it adds encryption overhead and complexity when the traffic is already within the AWS network, and it does not leverage the native Direct Connect integration for multi-VPC connectivity. Option D is wrong because ordering a second Direct Connect connection is an expensive and redundant solution; the existing connection can be reused with a Transit Gateway and a transit VIF to connect multiple VPCs, avoiding additional cost and provisioning delays.

Practice this question →
79
MCQhard

An organization uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to implement traffic inspection between VPCs using a third-party firewall appliance in a central VPC. The firewall must inspect traffic for all inter-VPC flows. Which architecture meets this requirement?

A.Configure Transit Gateway route tables to send inter-VPC traffic to the inspection VPC's attachment, and enable appliance mode on the attachment.
B.Create VPC peering connections between all VPCs and route traffic through the central VPC.
C.Use a Network Load Balancer in the central VPC to distribute traffic to the firewall appliances.
D.Set up Direct Connect gateways and route all traffic through the on-premises network for inspection.
AnswerA

Appliance mode ensures that return traffic is sent back through the same firewall, enabling stateful inspection.

Why this answer

Enabling appliance mode on a Transit Gateway attachment forces the Transit Gateway to preserve the source MAC address and use flow hash-based load balancing for traffic sent to the inspection VPC. This ensures that all inter-VPC traffic is routed through the third-party firewall appliance in the central VPC, allowing stateful inspection to work correctly. Without appliance mode, the Transit Gateway would perform MAC address rewriting, breaking the firewall's ability to track sessions.

Exam trap

The trap here is that candidates often assume VPC peering or a Network Load Balancer can be used for transitive routing or traffic interception, but they fail to recognize that Transit Gateway with appliance mode is the only AWS-native way to force all inter-VPC traffic through a central inspection VPC while preserving stateful firewall session integrity.

How to eliminate wrong answers

Option B is wrong because VPC peering connections do not support transitive routing; traffic between two peered VPCs cannot be routed through a third VPC, making it impossible to force all inter-VPC flows through a central inspection VPC. Option C is wrong because a Network Load Balancer (NLB) in the central VPC cannot intercept traffic that is not destined for it; inter-VPC traffic flows directly between VPC attachments in the Transit Gateway, and an NLB would only handle traffic explicitly sent to its target group, not all inter-VPC flows. Option D is wrong because using Direct Connect gateways to route all traffic through on-premises for inspection adds unnecessary latency, complexity, and cost, and does not leverage the Transit Gateway's native inspection capabilities; it also violates the requirement of using a central VPC within AWS.

Practice this question →
80
MCQeasy

A company is designing a multi-tier application with web servers in public subnets and database servers in private subnets. The database servers should only be accessible from the web servers. Which AWS feature should be used to enforce this?

A.Security groups that reference the web server security group as a source
B.VPC endpoints to restrict access to the database servers
C.Network ACLs with allow rules for the web server subnet CIDR
D.Network ACLs with deny rules for all traffic except from the web server subnet
AnswerA

Security groups allow you to specify another security group as the source, enabling fine-grained access control.

Why this answer

Security groups are stateful and act as a virtual firewall for individual instances. By referencing the web server security group as a source in the database security group's inbound rules, you allow traffic only from instances in that security group. This provides granular control at the instance level.

Option B is incorrect because VPC endpoints are used to privately connect to AWS services, not to restrict database access. Options C and D are incorrect because network ACLs are stateless and applied at the subnet level, not at the instance level, and they require explicit allow rules for return traffic. Using a NACL with allow rules for the web server subnet CIDR would still allow any instance in that subnet, not just the web servers, and would require managing ephemeral ports.

Practice this question →
81
MCQmedium

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via AWS Direct Connect. The on-premises network advertises the 10.0.0.0/8 prefix. One VPC has a route to the Transit Gateway for 0.0.0.0/0. Instances in that VPC can reach the internet via a NAT gateway but cannot reach on-premises resources. What is the most likely issue?

A.The security group of the instances does not allow inbound traffic from on-premises
B.The Direct Connect virtual interface is not associated with the Transit Gateway
C.The VPC route table does not have a route to the on-premises CIDR via the Transit Gateway
D.The on-premises router is not advertising the 10.0.0.0/8 prefix to AWS
AnswerC

A specific route for 10.0.0.0/8 via Transit Gateway must exist.

Why this answer

The VPC route table must have a specific route for the on-premises CIDR (10.0.0.0/8) pointing to the Transit Gateway. Without it, traffic destined for on-premises will use the 0.0.0.0/0 default route and go to the NAT gateway instead of the Transit Gateway. Option A is incorrect because the issue is routing, not security groups.

Option B is incorrect because the Direct Connect virtual interface must be associated with the Transit Gateway for connectivity, but the question states it is connected, and the problem is likely missing specific routes. Option D is incorrect because the on-premises router is advertising the prefix, but the VPC route table lacks the specific route.

Practice this question →
82
Multi-Selecteasy

A company has an AWS Direct Connect connection and wants to connect to multiple VPCs in the same region. Which TWO services can be used to achieve this? (Choose TWO.)

Select 2 answers
A.VPC Peering
B.AWS Transit Gateway
C.AWS Site-to-Site VPN
D.Direct Connect Gateway
E.AWS CloudHub
AnswersB, D

Transit Gateway can connect multiple VPCs and Direct Connect.

Why this answer

AWS Transit Gateway (Option B) acts as a central hub that interconnects VPCs and on-premises networks via a single Direct Connect connection, allowing you to connect to multiple VPCs in the same region without needing individual virtual interfaces. Direct Connect Gateway (Option D) enables you to associate multiple VPCs in the same or different regions with a single Direct Connect connection by using a single private virtual interface (VIF) and transit virtual interfaces (VIFs) to reach those VPCs through Transit Gateway or virtual private gateways.

Exam trap

The trap here is that candidates often confuse VPC Peering (Option A) as a way to extend Direct Connect connectivity to multiple VPCs, but VPC Peering does not support transitive routing and cannot be used to route traffic from Direct Connect to multiple VPCs without a central hub like Transit Gateway.

Practice this question →
83
Multi-Selectmedium

A company is using AWS Client VPN to provide remote access to their VPC. Users report that they can connect to the VPN but cannot reach resources in the VPC. Which THREE configuration items should the engineer verify?

Select 3 answers
A.The authorization rules allow access to the VPC's CIDR.
B.The Client VPN endpoint is associated with the correct subnets.
C.The Client VPN endpoint has a public IP address.
D.The security groups attached to the target resources allow traffic from the VPN CIDR.
E.The client certificate is issued by a valid CA.
AnswersA, B, D

Authorization rules define which networks users can access.

Why this answer

Authorization rules in AWS Client VPN define which networks (CIDRs) users are allowed to access. If the rule does not include the VPC's CIDR, traffic to resources in the VPC will be dropped even though the VPN tunnel is established. This is a common misconfiguration that prevents resource reachability.

Exam trap

The ANS-C01 exam often tests the distinction between authentication (certificate validity) and authorization (network access rules), leading candidates to incorrectly select certificate issues when the problem is actually about routing or security group rules.

Practice this question →
84
MCQeasy

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add an additional non-overlapping CIDR to the VPC. What is a valid CIDR block they can add?

A.10.0.1.0/24
B.10.1.0.0/16
C.10.0.0.0/8
D.10.0.0.0/16
AnswerB

Non-overlapping, valid addition.

Why this answer

(10.1.0.0/16) is correct because it is a non-overlapping IPv4 CIDR block that does not conflict with the existing VPC CIDR of 10.0.0.0/16. In AWS, when adding a secondary CIDR to a VPC, the new block must be from the private IP address ranges (RFC 1918) and must not overlap with any existing CIDR blocks in the VPC. The 10.1.0.0/16 range is entirely separate from 10.0.0.0/16, as they are different /16 subnets within the 10.0.0.0/8 space.

Exam trap

The trap here is that candidates often assume any non-overlapping RFC 1918 block is valid, but they overlook that the new CIDR must not be a subset or superset of the existing CIDR, and AWS specifically requires the new block to be non-overlapping at the VPC level, not just at the subnet level.

How to eliminate wrong answers

Option A (10.0.1.0/24) is wrong because it falls within the existing VPC CIDR of 10.0.0.0/16, causing an overlap that AWS does not allow when adding a secondary CIDR. Option C (10.0.0.0/8) is wrong because it is a superset of the existing 10.0.0.0/16 and would overlap entirely, which is not permitted. Option D (10.0.0.0/16) is wrong because it is identical to the existing CIDR block, resulting in a direct overlap that AWS rejects.

Practice this question →
85
MCQeasy

Refer to the exhibit. A flow log record shows ACCEPT for traffic from 10.0.1.5 to 10.0.2.10 on port 443. Which AWS service is most likely the destination?

A.Amazon RDS instance
B.Application Load Balancer
C.NAT Gateway
D.Amazon S3
AnswerB

ALB listens on port 443 for HTTPS.

Why this answer

An Application Load Balancer (ALB) terminates HTTPS (port 443) connections and forwards traffic to targets. Flow logs showing ACCEPT for traffic to port 443 on an ALB's internal IP (10.0.2.10) are expected because the ALB listens on that port for incoming client connections. The ALB operates at Layer 7 and is the only listed service that natively accepts HTTPS traffic on port 443 within a VPC.

Exam trap

AWS often tests the misconception that any service accepting HTTPS traffic must be an Amazon S3 endpoint, but S3 does not have a VPC private IP; the trap here is confusing a service's public endpoint with its internal VPC representation, leading candidates to pick S3 instead of recognizing the ALB's private IP and port 443 listener.

How to eliminate wrong answers

Option A is wrong because an Amazon RDS instance does not accept traffic on port 443 by default; it uses port 3306 (MySQL/Aurora), 5432 (PostgreSQL), or other database-specific ports, and HTTPS is not a native protocol for RDS. Option C is wrong because a NAT Gateway does not accept inbound traffic from private subnets; it only forwards outbound traffic from private instances to the internet and does not listen on port 443 for incoming connections. Option D is wrong because Amazon S3 is a global object storage service accessed via an S3 endpoint (e.g., bucket.s3.amazonaws.com) and does not have a VPC IP address like 10.0.2.10; S3 traffic uses HTTPS but the destination is an S3 API endpoint, not a private IP.

Practice this question →
86
MCQmedium

A company has an AWS Transit Gateway with multiple VPC attachments. They need to inspect traffic between VPCs using a third-party firewall appliance. What is the best approach?

A.Create a firewall VPC with the appliance and use Transit Gateway route tables to direct traffic through it
B.Use VPC security groups across VPCs
C.Use AWS Network Firewall directly in each VPC
D.Use network ACLs on each VPC subnet
AnswerA

This allows centralized inspection via routing.

Why this answer

The best approach is to create a dedicated firewall VPC that hosts the third-party firewall appliance and use Transit Gateway (TGW) route tables to steer inter-VPC traffic through that VPC. By attaching the firewall VPC to the TGW and configuring route tables with static routes pointing to the firewall VPC attachment, all traffic between other VPCs can be forced to traverse the firewall for inspection. This provides centralized, scalable traffic inspection without requiring changes to individual VPC routing or security group configurations.

Exam trap

The ANS-C01 exam often tests the misconception that security groups or network ACLs can be used for inter-VPC traffic inspection, but they are per-VPC constructs that cannot inspect traffic traversing a Transit Gateway.

How to eliminate wrong answers

Option B is wrong because VPC security groups are stateful, per-instance firewalls that operate at the ENI level and cannot inspect or forward traffic between VPCs; they are not designed for inter-VPC traffic inspection. Option C is wrong because AWS Network Firewall is a managed service that can be deployed in a single VPC but does not natively integrate with Transit Gateway to inspect traffic between multiple VPCs without additional routing complexity and does not support third-party firewall appliances. Option D is wrong because network ACLs are stateless, subnet-level packet filters that cannot perform deep packet inspection or application-layer filtering, and they cannot be used to route traffic through an external firewall appliance.

Practice this question →
87
MCQhard

A company is deploying a latency-sensitive application across two AWS Regions using Application Load Balancers (ALBs) and AWS Global Accelerator. The application uses TCP port 8443. Which configuration ensures the lowest possible latency for global users?

A.Use Amazon CloudFront with the ALBs as origins.
B.Use Amazon Route 53 latency-based routing with ALB endpoints in each Region.
C.Use AWS Global Accelerator with endpoints as the ALBs in each Region.
D.Deploy a Network Load Balancer in each Region and use Route 53 geoproximity routing.
AnswerC

Global Accelerator uses anycast and AWS backbone for lower latency.

Why this answer

AWS Global Accelerator uses the Anycast static IP addresses to route traffic over the AWS global network to the optimal ALB endpoint, minimizing internet hops and latency. For TCP port 8443, Global Accelerator preserves the client IP and provides connection termination at the edge, ensuring the lowest possible latency for global users by avoiding the public internet.

Exam trap

The ANS-C01 exam often tests the misconception that CloudFront can handle any TCP port or that DNS-based routing (Route 53) can match the latency performance of edge-optimized services like Global Accelerator, leading candidates to overlook the protocol limitations and routing inefficiencies.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront is a content delivery network optimized for HTTP/HTTPS traffic and does not support TCP port 8443 as a custom protocol; it only supports HTTP/HTTPS and WebSocket, so it cannot handle non-HTTP TCP traffic. Option B is wrong because Route 53 latency-based routing relies on DNS resolution, which introduces caching delays and does not provide static IP addresses, leading to suboptimal routing and higher latency compared to Global Accelerator's edge routing. Option D is wrong because deploying Network Load Balancers with Route 53 geoproximity routing still depends on DNS-based routing, which lacks the edge optimization and static IP benefits of Global Accelerator, and NLB does not provide the same application-layer health checks and traffic management as ALB for TCP port 8443.

Practice this question →
88
MCQmedium

A network engineer is assigned an IAM policy to manage VPC resources. The engineer attempts to create a VPC with CIDR 10.0.0.0/16 and fails. What is the reason?

A.The resource ARN in the Deny statement does not match the VPC being created.
B.The Deny statement overrides the Allow statement for the specific CIDR.
C.The condition in the Deny statement is not evaluated correctly.
D.The first statement allows only specific actions, not CreateVpc.
AnswerB

Explicit deny overrides allow.

Why this answer

The IAM policy includes an explicit Deny statement that denies the CreateVpc action when the CIDR block equals 10.0.0.0/16. Since explicit Deny statements override any Allow statements, the engineer's attempt to create a VPC with that specific CIDR fails regardless of any Allow permissions. This is a fundamental IAM evaluation logic rule: an explicit Deny always takes precedence over an Allow.

Exam trap

The ANS-C01 exam often tests the misconception that an Allow statement always grants permission, but the trap here is that an explicit Deny statement with a matching condition overrides any Allow, causing the operation to fail even if the user has broad permissions.

How to eliminate wrong answers

Option A is wrong because the resource ARN in a Deny statement for CreateVpc does not need to match the VPC being created — VPCs are created without a pre-existing ARN, and IAM policies for CreateVpc typically use a wildcard ARN (arn:aws:ec2:*:*:vpc/*) or no resource ARN at all; the issue is the CIDR condition, not the ARN. Option C is wrong because the condition in the Deny statement is evaluated correctly — IAM conditions are evaluated as expected, and the Deny statement's condition (StringEquals on the CIDR) matches the requested CIDR, causing the denial. Option D is wrong because the first statement allows specific actions, but the presence of an explicit Deny for CreateVpc with the matching CIDR overrides that Allow; the Allow statement is not the reason for the failure.

Practice this question →
89
MCQeasy

A network engineer is troubleshooting an AWS Direct Connect connection that is experiencing high latency. The connection is a 1 Gbps dedicated connection. The engineer notices that the link utilization is at 90%. What is the MOST likely cause of the high latency?

A.The virtual interface is configured as private instead of public
B.BGP keepalive timer misconfiguration
C.High bandwidth utilization causing queuing
D.The use of jumbo frames
AnswerC

Correct; when utilization is high, packets are queued, increasing latency.

Why this answer

High bandwidth utilization (90%) leads to queuing delays as packets wait in buffers, increasing latency. Option A is incorrect: the virtual interface type (private vs public) does not directly cause high latency. Option B is incorrect: BGP keepalive timer misconfiguration affects BGP session stability, not latency.

Option D is incorrect: jumbo frames can reduce latency by reducing overhead, not increase it.

Practice this question →
90
MCQhard

A financial services company is migrating its on-premises data center to AWS. The company has a three-tier application that consists of web servers, application servers, and a database. The application servers must communicate with the database using a private IP address. The database is hosted on an Amazon RDS for MySQL instance in a private subnet. The application servers are in a public subnet. The company has a security requirement that all traffic between the application servers and the database must be encrypted in transit. The network engineer has created a security group for the RDS instance that allows inbound traffic on port 3306 from the security group of the application servers. The engineer has also enabled encryption at rest for the RDS instance. During a security audit, it is discovered that traffic between the application servers and the database is not encrypted. The application team confirms that the application is configured to connect to the database using standard MySQL client library without any SSL/TLS options. The network engineer must ensure that all traffic between the application servers and the database is encrypted without modifying the application code. What should the network engineer do?

A.Create an AWS Site-to-Site VPN connection between the application servers' subnet and the database subnet to encrypt all traffic.
B.Enable the 'require_secure_transport' parameter in the RDS parameter group and set it to ON.
C.Deploy a Network Load Balancer (NLB) with a TLS listener in front of the RDS instance. Configure the NLB to terminate TLS from the application servers and forward traffic to the RDS instance using TLS.
D.Modify the security group for the RDS instance to only allow traffic from the application servers' security group on port 3306 with the 'tls' protocol.
AnswerB

Incorrect. Enabling 'require_secure_transport' forces the MySQL client to use TLS, but the application does not support TLS, so the connection would be rejected.

Why this answer

Enabling the 'require_secure_transport' parameter in the RDS parameter group ensures that the database only accepts encrypted connections. Although the application currently uses standard MySQL client libraries without SSL/TLS options, the connection configuration can be updated to enable SSL/TLS without modifying the application code—this is a configuration change, not a code change. Once the client is configured, all traffic is encrypted in transit.

Option A is invalid because AWS Site-to-Site VPN is designed for connecting on-premises networks to a VPC, not for subnets within the same VPC. Option C would require the application to initiate a TLS connection to the NLB, which it does not support, and would not encrypt traffic between the NLB and RDS unless also configuring TLS there, adding unnecessary complexity. Option D is incorrect because security groups do not have a 'tls' protocol; they only control IP and port access.

Practice this question →
91
Multi-Selecteasy

Which TWO of the following are benefits of using AWS Global Accelerator? (Choose TWO.)

Select 2 answers
A.Static anycast IP addresses that serve as a fixed entry point
B.Built-in AWS WAF capabilities
C.Content caching similar to CloudFront
D.DNS-based load balancing
E.Improved application performance by using edge locations
AnswersA, E

Provides consistent IP addresses.

Why this answer

AWS Global Accelerator uses static anycast IP addresses that serve as a fixed entry point, allowing traffic to enter the AWS global network at the closest edge location. This eliminates the need to update DNS records or client configurations when backend endpoints change, providing a stable endpoint for applications.

Exam trap

The ANS-C01 exam often tests the misconception that Global Accelerator provides caching or DNS-based load balancing, when in fact it uses anycast IP routing for traffic optimization and does not cache content or rely on DNS resolution for load distribution.

Practice this question →
92
MCQmedium

A network engineer runs the above command to list VPC endpoints. The engineer notices that the second endpoint (vpce-0b2c3d4e5f6g7h8i9) does not have a policy document displayed. What does this indicate?

A.The endpoint is configured to use an AWS managed policy that is not shown.
B.The endpoint is not active and needs to be recreated.
C.The endpoint is for DynamoDB, which does not support endpoint policies.
D.The endpoint has the default full-access policy.
AnswerD

If no custom policy is specified, the default policy allows full access.

Why this answer

When a VPC endpoint is created without a custom policy document, AWS automatically applies a default full-access policy that allows all principals to perform all actions on all resources through the endpoint. The AWS CLI command `describe-vpc-endpoints` omits the policy field when the default policy is in effect, because the default policy is not stored as a separate document; it is an implicit behavior of the endpoint. Therefore, the absence of a policy document in the output indicates the endpoint is using the default full-access policy, making option D correct.

Exam trap

The trap here is that candidates assume a missing policy document means the endpoint has no policy or is broken, when in fact AWS omits the default full-access policy from the CLI output, leading to confusion with inactive endpoints or service-specific limitations.

How to eliminate wrong answers

Option A is wrong because AWS does not attach a managed policy to a VPC endpoint; endpoint policies are resource-based policies, not IAM managed policies, and the absence of a policy document is not due to a hidden managed policy. Option B is wrong because an inactive endpoint would show a state of 'failed' or 'pending' in the output, not simply a missing policy document; the command still displays the policy field even for inactive endpoints if one was attached. Option C is wrong because DynamoDB endpoints do support endpoint policies; the misconception that they do not is incorrect, and the absence of a policy document in this case is due to the default policy, not a service limitation.

Practice this question →
93
MCQmedium

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company wants to ensure that traffic can only go out to the internet and not be initiated from the internet. Which configuration should be used?

A.Attach an Internet Gateway to the private subnets
B.Deploy a NAT Gateway in a public subnet and update the private subnet route table
C.Set up a VPN connection to an on-premises network
D.Create a VPC endpoint for S3
AnswerB

A NAT Gateway deployed in a public subnet with an Elastic IP enables outbound-only internet access for instances in private subnets, because the gateway translates private source IPs to the public IP and drops unsolicited inbound traffic. This satisfies the constraint that traffic can only be initiated from the private subnets, not from the internet.

Why this answer

A NAT Gateway deployed in a public subnet with an Elastic IP allows private subnet instances to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet’s route table must include a default route (0.0.0.0/0) pointing to the NAT Gateway, which translates the private source IP to the gateway’s Elastic IP for return traffic. This meets the requirement of outbound-only internet access without exposing private instances to inbound initiation.

Exam trap

The trap here is that candidates often confuse an Internet Gateway with a NAT Gateway, assuming both provide outbound-only access, but an Internet Gateway enables bidirectional traffic and requires public IPs on instances, while a NAT Gateway specifically allows outbound-only initiation from private instances.

How to eliminate wrong answers

Option A is wrong because attaching an Internet Gateway directly to private subnets would assign public IPs to instances and allow bidirectional traffic, violating the requirement that traffic cannot be initiated from the internet. Option C is wrong because a VPN connection to an on-premises network provides private connectivity to a corporate data center, not direct internet access for software updates; it would route traffic through the on-premises network, adding latency and complexity without solving the internet access need. Option D is wrong because a VPC endpoint for S3 only provides private connectivity to Amazon S3, not general internet access for software updates from arbitrary internet hosts.

Practice this question →
94
MCQmedium

A company is migrating on-premises workloads to AWS using AWS Direct Connect. The company has two Direct Connect connections from different providers for redundancy. Which configuration ensures seamless failover with automatic traffic rerouting?

A.Create two Direct Connect gateways, each attached to a separate Transit Gateway, and advertise the same prefixes via BGP.
B.Use one Direct Connect connection as primary and the other as standby with static routes.
C.Connect both Direct Connect connections to the same Virtual Private Gateway (VGW) and enable BGP.
D.Use a VPN connection over the internet as a backup for the Direct Connect links.
AnswerA

Enables automatic failover using BGP path selection.

Why this answer

Using two Direct Connect gateways, each attached to a separate Transit Gateway, with the same BGP prefixes advertised from both connections enables active-active or active-passive failover via BGP path selection (e.g., AS_PATH prepending or MED). This design ensures automatic traffic rerouting if one connection fails, as BGP withdraws the failed path and the remaining path takes over without manual intervention.

Exam trap

The trap here is that candidates assume both Direct Connect connections must terminate on the same Virtual Private Gateway (VGW) for redundancy, but AWS does not support multiple Direct Connect connections to a single VGW, making the dual Direct Connect gateway and Transit Gateway design the correct approach.

How to eliminate wrong answers

Option B is wrong because static routes require manual intervention or additional scripting to fail over, and they do not provide automatic, seamless rerouting like BGP does. Option C is wrong because connecting both Direct Connect connections to the same Virtual Private Gateway (VGW) is not supported — a VGW can only be associated with a single Direct Connect connection at a time, and using two connections with the same VGW would cause BGP conflicts and asymmetric routing. Option D is wrong because using a VPN over the internet as a backup introduces latency, bandwidth limitations, and potential security concerns; it is not a seamless failover solution for Direct Connect and does not leverage the same BGP-based automatic rerouting.

Practice this question →
95
Multi-Selecthard

Which THREE considerations are important when implementing a multi-region Direct Connect architecture? (Choose 3)

Select 3 answers
A.Ensure Direct Connect connections are in at least two separate geographic locations.
B.Use a single Direct Connect connection to reduce complexity.
C.Connect all Direct Connect connections to the same AWS Direct Connect device.
D.Use diverse paths and providers for the Direct Connect connections.
E.Set up a VPN connection as a backup to Direct Connect.
AnswersA, D, E

Diverse locations provide redundancy against site failures.

Why this answer

Implementing Direct Connect connections in at least two separate geographic locations ensures physical diversity and resilience against regional outages. This aligns with AWS best practices for high availability, as a single location failure (e.g., due to natural disaster or fiber cut) would not impact all connections, maintaining connectivity to your VPCs.

Exam trap

The trap here is that candidates often assume a single Direct Connect connection with a VPN backup is sufficient for multi-region architectures, but the question specifically requires multi-region Direct Connect, where physical and path diversity across locations is mandatory, not just a backup VPN.

Practice this question →
96
MCQeasy

A company is setting up a Direct Connect connection to AWS. They have a virtual private gateway (VGW) attached to their VPC. They need to establish a single logical connection over the Direct Connect link to access all subnets in the VPC. Which resource should they create on the Direct Connect virtual interface?

A.A private virtual interface (VIF) with a BGP session to the VGW.
B.A hosted virtual interface (VIF) provided by an AWS Partner.
C.A public virtual interface (VIF) with a BGP session to the VGW.
D.A transit virtual interface (VIF) to the VGW.
AnswerA

Private VIF allows access to the entire VPC via the VGW.

Why this answer

A private virtual interface (VIF) is the correct resource because it allows you to connect your on-premises network directly to a VPC via a Direct Connect link. By associating the private VIF with a virtual private gateway (VGW) and establishing a BGP session, you create a single logical connection that provides Layer 3 access to all subnets in the VPC, as the VGW handles routing between the Direct Connect link and the VPC's route tables.

Exam trap

The trap here is that candidates confuse a public VIF with private VPC access, mistakenly thinking a public VIF can reach private subnets via the VGW, but a public VIF only provides access to AWS public endpoints and cannot be associated with a VGW.

How to eliminate wrong answers

Option B is wrong because a hosted virtual interface is provisioned by an AWS Partner and is typically used when you do not own the Direct Connect connection; it still requires a private VIF or transit VIF to connect to a VGW, and it does not inherently provide a single logical connection to all subnets. Option C is wrong because a public virtual interface provides access to AWS public services (e.g., S3, DynamoDB) using public IP addresses, not to private VPC subnets; it cannot be associated with a VGW for VPC access. Option D is wrong because a transit virtual interface is used to connect a Direct Connect gateway to a transit gateway for multi-VPC or hybrid network architectures, not to directly attach to a single VGW for a single VPC; it is overkill for this requirement and requires additional components.

Practice this question →
97
MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. They want to use BGP to advertise a specific /24 prefix from their on-premises network to AWS. After configuration, the prefix is not visible in the VPC route tables. The BGP session is established. What should the company check?

A.Verify that the prefix is included in the allowed prefixes list for the Direct Connect virtual interface
B.Ensure that route propagation is enabled on the VPC route table
C.Check that the BGP ASN on the customer gateway is unique and not conflicting
D.Add a static route in the VPC route table for the on-premises prefix
AnswerA

The virtual private gateway only accepts prefixes that are in the allowed prefix list.

Why this answer

When a BGP session is established but the advertised prefix does not appear in VPC route tables, the most likely cause is that the prefix is not included in the allowed prefixes list configured on the Direct Connect virtual interface. AWS uses this list as a prefix filter; any prefix received via BGP that is not in the allowed list is silently ignored and not installed in the VPC route tables.

Exam trap

The ANS-C01 exam often tests the misconception that a BGP session being up guarantees routes are accepted, but the trap here is that AWS applies a mandatory prefix authorization list on Direct Connect virtual interfaces, and candidates overlook this filter when troubleshooting missing routes.

How to eliminate wrong answers

Option B is wrong because route propagation is enabled by default on VPC route tables when a Direct Connect virtual interface is attached, and if it were disabled, no routes from any BGP advertisement would appear, not just a specific /24. Option C is wrong because a BGP ASN conflict would prevent the BGP session from establishing or cause session flapping, but the question states the BGP session is already established. Option D is wrong because adding a static route for the on-premises prefix would bypass the BGP-learned route entirely and does not fix the missing BGP advertisement; the issue is with the BGP route not being accepted by AWS.

Practice this question →
98
MCQmedium

A network engineer is troubleshooting connectivity issues from an on-premises data center to an Amazon VPC via an AWS Site-to-Site VPN. The VPN tunnel is up, but ping from an on-premises host (10.0.0.5) to an EC2 instance (172.16.1.10) fails. The VPC CIDR is 172.16.0.0/16. The on-premises CIDR is 10.0.0.0/8. The customer gateway device has a route for 172.16.0.0/16 pointing to the VPN tunnel. The VPC route table has a route for 10.0.0.0/8 pointing to the virtual private gateway. Security groups and NACLs allow ICMP. What is the MOST likely cause?

A.The on-premises host does not have a route to the VPC CIDR
B.The customer gateway device is not configured with the correct pre-shared key
C.The route table associated with the EC2 instance's subnet does not have a route for the on-premises CIDR
D.The virtual private gateway is not attached to the correct VPC
AnswerC

Correct; the subnet route table must include a route for the on-premises CIDR pointing to the virtual private gateway.

Why this answer

The most likely cause is that the subnet route table associated with the EC2 instance's subnet does not have a route for the on-premises CIDR (10.0.0.0/8). Although the VPC's main route table has a route for 10.0.0.0/8 pointing to the virtual private gateway, the EC2 instance's subnet may be using a custom route table that lacks this route. Without it, the EC2 instance's return ICMP traffic to 10.0.0.5 is sent via the local route (which only covers the VPC CIDR 172.16.0.0/16) and does not reach the VPN tunnel, causing the ping to fail.

Practice this question →
99
MCQmedium

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets contain NAT gateways for outbound internet access from the private subnets. The private subnets host web servers that need to make API calls to an external service over the internet. After implementation, the web servers cannot reach the internet. Which configuration is the most likely cause?

A.The NAT gateway is placed in a private subnet and does not have a route to the internet gateway.
B.The route table for the private subnets is not associated with the VPC's main route table.
C.The private subnets have a default route (0.0.0.0/0) pointing to an internet gateway instead of the NAT gateway.
D.The public subnets have a default route pointing to the NAT gateway instead of the internet gateway.
AnswerA

NAT gateways must reside in a public subnet with a route to an internet gateway. If placed in a private subnet, outbound traffic cannot reach the internet.

Why this answer

A NAT gateway must be placed in a public subnet with a route to an internet gateway (IGW) to translate private IP addresses for outbound traffic. If the NAT gateway is in a private subnet, it cannot reach the IGW, so the private web servers' traffic destined for the internet (via the 0.0.0.0/0 route pointing to the NAT gateway) will fail, as the NAT gateway itself has no path to the internet.

Exam trap

The trap here is that candidates often assume a NAT gateway can be placed in any subnet and still function, but AWS explicitly requires the NAT gateway to reside in a public subnet with a route to an IGW for outbound connectivity.

How to eliminate wrong answers

Option B is wrong because route table association with the VPC's main route table is not required for private subnets; private subnets can have their own custom route table, and the issue is about the NAT gateway's placement, not the route table association. Option C is wrong because if the private subnets had a default route pointing to an IGW, the web servers would be able to reach the internet directly (though this would bypass the NAT gateway and expose private IPs), so this would not cause a failure to reach the internet. Option D is wrong because public subnets having a default route pointing to a NAT gateway instead of an IGW would break outbound internet access from the public subnets themselves, but it would not prevent private subnets from reaching the internet via the NAT gateway, as the NAT gateway's own routing is the critical factor.

Practice this question →
100
MCQhard

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket to download files. The company wants to avoid using a NAT gateway and minimize latency. Which solution should be used?

A.Create a VPC endpoint for S3 and attach it to the private subnet's route table.
B.Place the instance in a public subnet and use a NAT gateway.
C.Use a VPC endpoint for EC2.
D.Use an internet gateway and a route to 0.0.0.0/0.
AnswerA

Provides private, low-latency access to S3.

Why this answer

A VPC endpoint for S3 allows the EC2 instance in the private subnet to access S3 directly over the AWS network, avoiding internet-bound traffic and eliminating the need for a NAT gateway. This minimizes latency because traffic stays within the AWS backbone and does not traverse the public internet. Attaching the endpoint to the private subnet's route table ensures that S3-bound traffic is routed through the endpoint.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT gateway is required for private subnet internet access, but the trap here is that S3 can be accessed via a VPC endpoint without any internet gateway or NAT, and candidates may confuse VPC endpoints for S3 with those for other services like EC2 or DynamoDB.

How to eliminate wrong answers

Option B is wrong because placing the instance in a public subnet and using a NAT gateway would still route traffic through the internet, increasing latency and incurring NAT gateway costs, which contradicts the requirement to avoid a NAT gateway. Option C is wrong because a VPC endpoint for EC2 does not exist; VPC endpoints are available for services like S3 and DynamoDB, not for EC2 itself. Option D is wrong because using an internet gateway with a default route to 0.0.0.0/0 would require the instance to be in a public subnet with a public IP, which violates the private subnet requirement and introduces internet latency.

Practice this question →
101
Multi-Selectmedium

Which THREE of the following are features of AWS Transit Gateway? (Select THREE.)

Select 3 answers
A.Multicast support
B.Built-in NAT capabilities
C.Transitive routing between multiple VPCs
D.Centralized routing and management
E.Edge-to-edge routing for VPN connections
AnswersA, C, D

Transit Gateway supports multicast groups.

Why this answer

AWS Transit Gateway supports multicast traffic by acting as a multicast router within a VPC, enabling you to send a single stream of data to multiple receivers across different VPCs. This is achieved through the creation of a multicast domain and the association of subnets as sources or members, using IGMPv2 for group membership management.

Exam trap

The trap here is that candidates may confuse Transit Gateway's support for multicast with built-in NAT capabilities, or assume that edge-to-edge routing is a distinct feature when it is simply a consequence of Transit Gateway's ability to route between any attached networks.

Practice this question →
102
MCQeasy

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to connect two separate branch offices using AWS Client VPN. Each branch office has a different subnet: Branch A uses 10.0.1.0/24 and Branch B uses 10.0.2.0/24. The Client VPN endpoint is configured with a CIDR range of 10.0.3.0/24. The route table for the VPC has the local route and routes to the Client VPN endpoint. Users from both branches can connect to the VPN but cannot communicate with each other. What is the most likely reason?

A.The branch subnets 10.0.1.0/24 and 10.0.2.0/24 are part of the VPC CIDR, so the VPC routes traffic locally instead of via the VPN
B.The route tables in the branch subnets do not have routes to the Client VPN endpoint
C.The Client VPN endpoint is configured with a CIDR that overlaps with the branch subnets
D.The security group for the Client VPN endpoint does not allow inbound traffic from branch subnets
AnswerA

Local routes take precedence.

Why this answer

Branch subnets overlap with the VPC CIDR, causing routing conflicts. The VPC sees 10.0.1.0/24 and 10.0.2.0/24 as local, thus traffic destined to those addresses is routed locally within the VPC, not to the VPN. Options B and C are not relevant to inter-branch communication.

Option D would not cause the issue because branch subnets are within the VPC CIDR.

Practice this question →
103
MCQhard

A network engineer created a VPC endpoint for the service shown in the exhibit. The endpoint is in the 'available' state, but instances in the VPC cannot resolve the private DNS name 'example.com'. What is the most likely cause?

A.The VPC does not have a Route 53 private hosted zone for example.com
B.The VPC does not have an internet gateway
C.The endpoint does not have 'Private DNS names enabled'
D.The security group for the endpoint is blocking DNS traffic
AnswerC

Without enabling this option, the private DNS name is not resolved.

Why this answer

The private DNS name is only resolved via Route 53 private hosted zone if 'Private DNS names enabled' is set. The exhibit shows the service has a PrivateDnsName, but the endpoint must have 'Private DNS names enabled' for resolution to work.

Practice this question →
104
Multi-Selectmedium

A company is deploying a multi-tier web application across multiple Availability Zones in a VPC. The architecture includes public-facing Application Load Balancers, Amazon EC2 instances in private subnets, and an Amazon RDS for MySQL Multi-AZ DB instance. To meet compliance requirements, all traffic between the web tier and database tier must be encrypted and must not traverse the internet. Which TWO actions should the company take to implement this securely? (Choose two.)

Select 2 answers
A.Establish an AWS Site-to-Site VPN between the web tier subnets and the database subnet.
B.Create a VPC endpoint for Amazon RDS and route database traffic through it.
C.Enable SSL/TLS encryption on the RDS DB instance and configure the web servers to connect using SSL.
D.Assign an Elastic IP address to the RDS DB instance to ensure a stable IP for the web tier.
E.Use the RDS endpoint (DNS name) that resolves to a private IP within the same VPC.
AnswersC, E

Encrypts traffic between web and database tiers.

Why this answer

Enabling SSL/TLS encryption on the RDS DB instance and configuring the web servers to connect using SSL ensures that all traffic between the web tier and database tier is encrypted in transit. This satisfies the compliance requirement for encrypted traffic without needing external connectivity. Option E is correct because using the RDS endpoint (DNS name) that resolves to a private IP within the same VPC ensures that database traffic remains within the VPC and does not traverse the internet, meeting the compliance requirement for no internet traversal.

Exam trap

The trap here is that candidates may confuse VPC endpoints (which are used for AWS services like S3 or DynamoDB) with the need for private connectivity to RDS, but RDS within the same VPC already uses private IPs, and the real focus is on enabling SSL/TLS encryption and using the private DNS endpoint to keep traffic internal.

Practice this question →
105
MCQhard

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to add IPv6 support for its public-facing web application. The application must be accessible via both IPv4 and IPv6. The VPC already has an Internet Gateway attached. What is the correct set of steps to enable IPv6?

A.Assign a custom IPv6 CIDR block from your own range to the VPC and add a route to the Internet Gateway.
B.Associate an Amazon-provided IPv6 CIDR block to the VPC, add a route for ::/0 to the Internet Gateway, and allocate IPv6 addresses to the subnets.
C.Associate an IPv6 CIDR block, create an Egress-Only Internet Gateway, and route ::/0 to it.
D.Associate a /64 IPv6 CIDR block to the VPC, add a route for ::/0 to the Internet Gateway, and assign IPv6 addresses to instances.
AnswerB

Standard procedure for public IPv6 access.

Why this answer

To enable IPv6 in a VPC, you must associate an Amazon-provided IPv6 CIDR block (a /56 block by default), add a route for the IPv6 default route (::/0) to the Internet Gateway, and allocate IPv6 addresses to the subnets. The Internet Gateway already supports IPv6 traffic natively, so no additional gateway is required for public-facing IPv6 access.

Exam trap

The trap here is that candidates often confuse the need for an Egress-Only Internet Gateway with public-facing IPv6 access, but for inbound traffic, the regular Internet Gateway works for both IPv4 and IPv6.

How to eliminate wrong answers

Option A is wrong because you cannot assign a custom IPv6 CIDR block from your own range to a VPC; AWS only supports associating an Amazon-provided IPv6 CIDR block or using an IPv6 CIDR block from an IPAM pool. Option C is wrong because an Egress-Only Internet Gateway is used for outbound-only IPv6 traffic from private subnets, not for public-facing web applications that require inbound IPv6 access. Option D is wrong because the IPv6 CIDR block assigned to a VPC is a /56 block, not a /64, and you must allocate IPv6 addresses to subnets, not directly to instances.

Practice this question →
106
MCQeasy

A company is running a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application needs to store session state in an ElastiCache Redis cluster. The Redis cluster should not be accessible from the internet. Which network design should be used?

A.Place the Redis cluster in a public subnet and restrict access via security group.
B.Place the Redis cluster in a private subnet and the EC2 instances in a private subnet, with a NAT Gateway for outbound traffic.
C.Place the Redis cluster in a private subnet and the EC2 instances in a public subnet.
D.Place both the EC2 instances and the Redis cluster in private subnets with appropriate security groups.
AnswerD

Both in private subnets, security groups allow traffic from EC2 to Redis.

Why this answer

Placing both the EC2 instances and the ElastiCache Redis cluster in private subnets ensures that the Redis cluster is not accessible from the internet, meeting the security requirement. The EC2 instances can communicate with the Redis cluster within the same VPC using private IP addresses, and security groups can be used to restrict traffic to only the necessary ports (e.g., TCP 6379 for Redis) from the EC2 instances' security group. This design avoids exposing the Redis cluster to any public network, aligning with best practices for internal caching layers.

Exam trap

The trap here is that candidates may think a NAT Gateway is required for EC2 instances in private subnets to communicate with ElastiCache, but in reality, VPC internal traffic uses private IPs and does not require a NAT Gateway, which is only for outbound internet access.

How to eliminate wrong answers

Option A is wrong because placing the Redis cluster in a public subnet exposes it to the internet, even with a security group restriction, as public subnets have a route to an internet gateway, which violates the requirement that the Redis cluster should not be accessible from the internet. Option B is wrong because while the Redis cluster is in a private subnet, the EC2 instances are also in a private subnet, but the mention of a NAT Gateway for outbound traffic is unnecessary and irrelevant for internal communication between EC2 and Redis; the NAT Gateway is only needed for outbound internet access, which is not required here. Option C is wrong because placing the EC2 instances in a public subnet exposes them to the internet, which is unnecessary for a web application behind an ALB (the ALB handles public traffic), and it does not directly affect Redis accessibility, but the design is suboptimal and introduces unnecessary risk.

Practice this question →
107
MCQeasy

A company is deploying an application across multiple Availability Zones in a single AWS Region. The application requires that all traffic between EC2 instances in the same subnet be inspected by a network appliance. Which configuration should be used to meet this requirement?

A.Set up a VPC peering connection between the subnets
B.Use a Transit Gateway to route traffic through the appliance
C.Deploy AWS Network Firewall in the subnet
D.Create a Gateway Load Balancer and configure the appliance as a target
AnswerD

GWLB can be used to inspect all traffic between instances in the same subnet via a Gateway Load Balancer Endpoint.

Why this answer

A Gateway Load Balancer (GWLB) can inspect intra-subnet traffic between EC2 instances in the same subnet. Traffic between instances in the same subnet is Layer 2 and does not traverse route tables, so traditional routing methods cannot intercept it. GWLB uses Geneve encapsulation to transparently redirect traffic at the hypervisor level to the appliance targets without modifying the route table.

The appliance must be configured to handle this encapsulation. Other options do not support inspection of same-subnet traffic.

Exam trap

The ANS-C01 exam often tests the misconception that intra-subnet traffic can be intercepted by a firewall or routing construct, but in AWS, traffic between instances in the same subnet is Layer 2 and never hits a route table, so only a Gateway Load Balancer (or an inline appliance with proxy ARP) can inspect it.

How to eliminate wrong answers

Option A is wrong because VPC peering connects different VPCs, not subnets within the same VPC, and it does not provide any traffic inspection capability. Option B is wrong because a Transit Gateway is used for inter-VPC or hybrid connectivity, not for routing traffic within a single subnet; it cannot intercept intra-subnet traffic without complex overlay configurations. Option C is wrong because AWS Network Firewall is a managed firewall service that inspects traffic at the VPC or subnet boundary (e.g., ingress/egress), but it cannot inspect traffic between instances within the same subnet because that traffic does not traverse a route table or a firewall endpoint.

Practice this question →
108
MCQmedium

A company has a VPC with a public subnet and a private subnet. They have a NAT Gateway in the public subnet. They also have an EC2 instance in the private subnet that needs to access the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. The security group for the EC2 instance allows outbound HTTPS traffic. The network ACL for the private subnet allows inbound and outbound ephemeral ports. However, the EC2 instance cannot reach the internet. The network engineer checks the NAT Gateway and sees that it has an Elastic IP attached. The engineer also checks the route table for the public subnet and finds no route to the internet. What should the engineer do to fix the issue?

A.Deploy a second NAT Gateway in the private subnet.
B.Add a route in the public subnet route table to 0.0.0.0/0 via the internet gateway.
C.Add a route in the private subnet route table to 0.0.0.0/0 via the internet gateway.
D.Attach a second Elastic IP to the NAT Gateway.
AnswerB

This allows the NAT gateway to reach the internet.

Why this answer

The NAT Gateway resides in the public subnet, and for the NAT Gateway to forward traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway. Without that route, the NAT Gateway cannot send traffic to the internet, even though the private subnet's route points to the NAT Gateway. Options A, C, and D are incorrect: A is unnecessary because a NAT Gateway in the private subnet would not have direct internet access; C would bypass the NAT Gateway and require a route to the internet gateway directly from the private subnet, which is not the standard design; D is wrong because adding another Elastic IP does not solve the missing route issue.

Practice this question →
109
MCQeasy

A company is using AWS Direct Connect to connect its on-premises data center to a VPC. The company wants to use a single Direct Connect connection to connect to multiple VPCs in different AWS accounts. Which AWS service should be used to achieve this?

A.Direct Connect Gateway
B.Transit Gateway
C.AWS Site-to-Site VPN
D.VPC Peering
AnswerA

Direct Connect Gateway enables connectivity to multiple VPCs over a single Direct Connect connection.

Why this answer

A Direct Connect Gateway (DX Gateway) is the correct service because it allows a single Direct Connect connection to be associated with multiple VPCs across different AWS accounts and regions. The DX Gateway acts as a regional or global transit hub, enabling private connectivity from on-premises to multiple VPCs without needing separate Direct Connect connections for each VPC. This is achieved by associating the DX Gateway with virtual private gateways (VGWs) in each target VPC, and then using AWS Resource Access Manager (RAM) to share the DX Gateway with other accounts.

Exam trap

The trap here is that candidates often confuse Transit Gateway with Direct Connect Gateway, thinking Transit Gateway can natively handle multi-account Direct Connect sharing, but Transit Gateway requires a Direct Connect Gateway attachment to do so, making the Direct Connect Gateway the essential component for this specific use case.

How to eliminate wrong answers

Option B (Transit Gateway) is wrong because Transit Gateway is a network transit hub for connecting VPCs and on-premises networks within a single account, but it does not natively support sharing a single Direct Connect connection across multiple AWS accounts without additional configuration like a Direct Connect Gateway. Option C (AWS Site-to-Site VPN) is wrong because it is an IPsec VPN-based solution that uses the public internet, not a dedicated private Direct Connect connection, and it cannot leverage a single Direct Connect link for multiple VPCs across accounts. Option D (VPC Peering) is wrong because VPC Peering is a one-to-one connection between two VPCs, does not support transitive routing, and cannot be used to connect an on-premises data center to multiple VPCs via a single Direct Connect connection.

Practice this question →
110
Multi-Selectmedium

Which TWO options are valid methods to connect a VPC to an on-premises network? (Choose 2)

Select 2 answers
A.Internet gateway
B.AWS Direct Connect
C.VPC endpoint
D.VPC peering connection
E.AWS Site-to-Site VPN
AnswersB, E

Direct Connect provides a dedicated private connection from on-premises to AWS.

Why this answer

AWS Site-to-Site VPN and AWS Direct Connect are the two primary services for hybrid connectivity. VPC peering is for VPC-to-VPC, not on-premises. VPC endpoints are for accessing AWS services privately.

Internet gateway is for public internet access.

Practice this question →
111
MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. They also have a VPN connection as a backup. They want to ensure that traffic always uses the Direct Connect connection when it is available, and only fails over to the VPN if Direct Connect goes down. How should they configure routing?

A.Advertise a more specific prefix over Direct Connect and a less specific prefix over VPN.
B.Use static routes pointing to the Direct Connect virtual interface with a lower metric than the VPN route.
C.Advertise the same prefix over both connections but with a lower AS path length over Direct Connect.
D.Advertise the same prefix over both connections but set a higher weight on the VPN BGP session.
AnswerA

BGP always prefers the most specific prefix (longest match). This ensures Direct Connect is used when available.

Why this answer

BGP selects the most specific prefix (longest prefix match) first, regardless of other attributes. By advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /16) over VPN, traffic will always prefer the Direct Connect path when it is available. If Direct Connect fails, the more specific prefix is withdrawn, and traffic automatically falls back to the VPN using the less specific prefix.

Exam trap

The ANS-C01 exam often tests the misconception that BGP attributes like AS path length or weight are the primary tie-breakers, but in this scenario the longest prefix match rule overrides all BGP path attributes, making prefix specificity the correct mechanism for active/passive failover.

How to eliminate wrong answers

Option B is wrong because static routes with a lower metric (administrative distance) would work only if both routes are static; however, BGP routes have a default administrative distance of 20 for eBGP, and static routes have an AD of 1, so a static route pointing to Direct Connect would actually be preferred over BGP, but the question requires BGP-based failover, and static routes do not dynamically withdraw on failure. Option C is wrong because advertising the same prefix with a lower AS path length over Direct Connect would make Direct Connect preferred only if both prefixes are identical; however, if the Direct Connect fails, the VPN route would still have the same prefix and would be used, but the AS path manipulation does not guarantee failover behavior when the Direct Connect BGP session goes down—the prefix is simply withdrawn. Option D is wrong because setting a higher weight on the VPN BGP session would make the VPN route preferred over Direct Connect, which is the opposite of the desired behavior; weight is a Cisco-proprietary attribute that is locally significant and evaluated before AS path length.

Practice this question →
112
Multi-Selectmedium

Which TWO of the following are true about using a Network Load Balancer (NLB) with AWS PrivateLink? (Choose 2.)

Select 2 answers
A.NLB supports Server Name Indication (SNI)
B.NLB can perform TLS termination
C.NLB supports sticky sessions by default
D.NLB can be assigned Elastic IPs
E.NLB can be used as a service provider in a VPC endpoint service
AnswersD, E

NLB supports static IPs via Elastic IPs.

Why this answer

A Network Load Balancer (NLB) supports the assignment of Elastic IPs (EIPs) per Availability Zone, which provides a static, fixed IP address for the NLB. This is critical for AWS PrivateLink, as the service provider's VPC endpoint service uses the NLB's IP addresses to accept traffic from consumer VPCs, ensuring the endpoint remains reachable even if the underlying instances change.

Exam trap

The trap here is that candidates often confuse NLB's ability to be assigned Elastic IPs with the misconception that NLB can terminate TLS or support SNI, but NLB is a Layer 4 load balancer and does not inspect HTTP headers, making SNI impossible, while TLS termination is an optional feature not inherent to PrivateLink usage.

Practice this question →
113
MCQhard

A company is deploying a multi-tier application across multiple VPCs connected via AWS Transit Gateway. The web tier must be able to initiate connections to the app tier, but the app tier must not be able to initiate connections to the web tier. How can this be achieved?

A.Configure network ACLs on the web tier subnets to allow outbound traffic and deny inbound from app tier.
B.Establish VPC peering between the web and app VPCs and restrict routes.
C.Use security groups across the VPCs by referencing each other's CIDR blocks.
D.Deploy a centralized firewall appliance in a shared VPC and use Transit Gateway to route all inter-VPC traffic through it.
AnswerD

Enables stateful inspection and unidirectional rules.

Why this answer

Routing all inter-VPC traffic through a centralized firewall appliance in a shared VPC via Transit Gateway allows you to enforce stateful inspection and access control policies. The firewall can be configured to permit only outbound connections from the web tier to the app tier while blocking any inbound connections initiated by the app tier, thus meeting the requirement without relying on VPC-native constructs that cannot enforce unidirectional stateful filtering across VPCs.

Exam trap

The trap here is that candidates assume security groups or network ACLs can enforce unidirectional traffic across VPCs, but they are either stateless (NACLs) or stateful (security groups) and cannot prevent the app tier from initiating new connections when return traffic is allowed.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and operate at the subnet level; they cannot track connection state, so allowing outbound traffic from the web tier would require an ephemeral port range inbound rule that would also permit the app tier to initiate connections back. Option B is wrong because VPC peering provides no mechanism to enforce unidirectional traffic flow; routes are symmetric, and security groups or NACLs would still allow return traffic, not prevent the app tier from initiating new connections. Option C is wrong because security groups cannot be referenced across VPCs by CIDR blocks alone; cross-VPC security group referencing is only supported with VPC peering or Transit Gateway, and even then, security groups are stateful and would allow return traffic, not block the app tier from initiating connections.

Practice this question →
114
MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. They want to use the same connection to access another VPC in a different region. What is the simplest way to achieve this?

A.Use a Direct Connect Gateway
B.Create a new private VIF for the second VPC
C.Use a VPN over the internet to connect the VPCs
D.Set up VPC peering between the two VPCs
AnswerA

Direct Connect Gateway enables multi-VPC connectivity across regions over the same private VIF.

Why this answer

A Direct Connect Gateway (DX Gateway) allows you to associate a single private virtual interface (VIF) with multiple VPCs, even across different AWS regions. This is the simplest solution because it avoids creating additional VIFs or complex inter-VPC connectivity, and it supports transitive routing between the on-premises network and all associated VPCs via the same Direct Connect connection.

Exam trap

The ANS-C01 exam often tests the misconception that a private VIF is tied to a single VPC or region, leading candidates to incorrectly choose creating a new VIF for each VPC, when a Direct Connect Gateway is the designed solution for multi-VPC and multi-region connectivity.

How to eliminate wrong answers

Option B is wrong because creating a new private VIF for the second VPC would require an additional physical or logical interface on the same Direct Connect connection, which is more complex and unnecessary when a DX Gateway can handle multiple VPCs. Option C is wrong because using a VPN over the internet introduces latency, bandwidth limitations, and security overhead, and it does not leverage the existing Direct Connect private connectivity. Option D is wrong because VPC peering does not extend the on-premises Direct Connect connection to the second VPC; it only enables direct communication between the two VPCs, but the on-premises network would still need a separate path to reach the second VPC.

Practice this question →
115
MCQmedium

A company is using AWS CloudFormation to deploy a VPC with two public subnets and two private subnets across two Availability Zones. The template includes an internet gateway and a NAT gateway in each public subnet. The company needs to ensure that instances in the private subnets can access the internet. Which route table configuration should be used?

A.Add a route to the internet gateway in the private subnet route tables.
B.Add a route to the NAT gateway in the public subnet route tables.
C.Add a route 0.0.0.0/0 pointing to the NAT gateway in the same AZ in each private subnet route table.
D.Add a route 0.0.0.0/0 pointing to a single NAT gateway in both private subnet route tables.
AnswerC

Provides high availability and AZ independence.

Why this answer

Private subnets require a default route (0.0.0.0/0) pointing to a NAT gateway in the same Availability Zone to ensure internet-bound traffic is source-NATed. This design maintains high availability by avoiding cross-AZ data transfer costs and single points of failure. The NAT gateway must be placed in a public subnet, and the private subnet route table must explicitly direct traffic to it.

Exam trap

The trap here is that candidates often assume a single NAT gateway is sufficient for cost savings, overlooking the high-availability requirement and cross-AZ data transfer costs that AWS explicitly tests in multi-AZ VPC designs.

How to eliminate wrong answers

Option A is wrong because adding a route to the internet gateway in private subnet route tables would allow direct internet access, bypassing NAT and exposing private instances with public IPs, which violates the requirement for private instances to only have outbound internet access. Option B is wrong because adding a route to the NAT gateway in public subnet route tables is unnecessary; public subnets already route 0.0.0.0/0 to the internet gateway, and NAT gateways are targets for private subnets, not public ones. Option D is wrong because pointing both private subnet route tables to a single NAT gateway creates a single point of failure and incurs cross-AZ data transfer costs, violating best practices for high availability in a multi-AZ deployment.

Practice this question →
116
Drag & Dropmedium

Order the steps to set up a Network Load Balancer with a TCP listener in front of an Auto Scaling group:

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First create the target group, then the load balancer, register targets, associate the target group with the listener, and configure health checks.

Practice this question →
117
Multi-Selectmedium

A company is designing a VPC with multiple subnets. The company wants to use VPC Flow Logs to monitor network traffic. Which TWO of the following are valid destinations for VPC Flow Logs?

Select 2 answers
A.Amazon RDS
B.Amazon CloudWatch Logs
C.Amazon S3
D.Amazon SQS
E.Amazon Kinesis Data Firehose
AnswersB, C

Supported destination.

Why this answer

VPC Flow Logs can publish flow log records directly to Amazon CloudWatch Logs, where you can view, search, and filter log data using the CloudWatch Logs console or API. This destination is enabled by default when you create a flow log via the AWS Management Console, making it the most common integration point for monitoring and alerting on network traffic patterns.

Exam trap

The ANS-C01 exam often tests that candidates confuse supported destinations with downstream integrations; the trap here is that Kinesis Data Firehose is a valid downstream target via a CloudWatch Logs subscription filter, but it is not a direct destination for VPC Flow Logs.

Practice this question →
118
Multi-Selectmedium

A company is deploying a multi-tier web application on AWS. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets across multiple Availability Zones. The security team requires that all traffic between the ALB and the EC2 instances be encrypted using TLS. The application must also support HTTP health checks from the ALB. Which TWO actions should the network engineer take to meet these requirements? (Choose TWO.)

Select 2 answers
A.Configure the ALB listener to use HTTP and enable stickiness.
B.Install a certificate on each EC2 instance and configure the target group to use HTTPS.
C.Configure the ALB listener to use HTTPS and set the target group protocol to HTTP.
D.Configure the target group health check to use HTTPS.
E.Configure the security group for EC2 instances to allow inbound HTTP traffic from the ALB.
AnswersB, D

Installing a certificate on instances allows TLS termination, and HTTPS target group ensures encrypted health checks.

Why this answer

Installing a certificate on each EC2 instance and configuring the target group to use HTTPS ensures that traffic between the ALB and the EC2 instances is encrypted using TLS. This meets the security requirement for end-to-end encryption, as the ALB will establish a TLS connection with the instances using the installed certificate.

Exam trap

The trap here is that candidates often assume setting the ALB listener to HTTPS is sufficient for end-to-end encryption, overlooking that the target group protocol must also be HTTPS to encrypt the ALB-to-instance traffic.

Practice this question →
119
MCQhard

A company is setting up a new AWS account and wants to centrally manage VPC network traffic inspection across multiple accounts using a central VPC. The company uses AWS Organizations. Which architecture meets these requirements?

A.Create VPC peering connections between each account's VPC and the central VPC.
B.Use AWS Transit Gateway with a central inspection VPC that has firewall appliances.
C.Use VPC endpoints to route traffic to the central VPC.
D.Deploy a Network Load Balancer in each VPC and route traffic through it.
AnswerB

TGW enables hub-and-spoke architecture with inspection.

Why this answer

AWS Transit Gateway acts as a hub-and-spoke router, enabling centralized network traffic inspection by routing inter-VPC and VPN traffic through a central inspection VPC that hosts firewall appliances (e.g., third-party NGFWs or AWS Network Firewall). This architecture scales across multiple accounts in AWS Organizations using resource sharing via AWS Resource Access Manager, and it supports granular route tables to force traffic through the inspection VPC without requiring peering mesh or single points of failure.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering can be used for transitive routing (i.e., routing traffic through a third VPC), but VPC peering is non-transitive and cannot forward traffic between two peered VPCs via a central VPC.

How to eliminate wrong answers

Option A is wrong because VPC peering connections create a flat, non-transitive mesh; traffic between two peered VPCs cannot be routed through a third VPC (e.g., the central inspection VPC) without complex and unscalable workarounds, and it does not support centralized inspection across many accounts. Option C is wrong because VPC endpoints (Gateway or Interface endpoints) are designed for private connectivity to AWS services (e.g., S3, DynamoDB) or specific endpoint services, not for routing general inter-VPC or internet-bound traffic through a central inspection VPC. Option D is wrong because a Network Load Balancer operates at Layer 4 and is used for load balancing TCP/UDP traffic, not for routing or inspecting traffic between VPCs; it cannot enforce traffic inspection policies or act as a central routing hub.

Practice this question →
120
MCQhard

A company has a VPC with multiple subnets that are peered with another VPC using a VPC Peering connection. They want to ensure that traffic between the two VPCs is encrypted. What should they do?

A.Configure network ACLs to enforce encryption.
B.Use AWS Transit Gateway with a VPN attachment between the VPCs.
C.Use AWS Direct Connect with a public VIF.
D.Enable encryption on the VPC Peering connection using a security group.
AnswerB

Transit Gateway with VPN can provide encrypted connectivity between VPCs.

Why this answer

VPC Peering does not support encryption of traffic in transit. To encrypt traffic between VPCs, you can use AWS Transit Gateway with a VPN attachment, which establishes an IPsec VPN tunnel that encrypts all traffic between the VPCs. This solution meets the requirement for encrypted inter-VPC communication while still allowing connectivity across multiple subnets.

Exam trap

The trap here is that candidates assume VPC Peering can be encrypted via security groups or ACLs, but AWS does not support encryption on VPC Peering connections, and the correct solution requires a Transit Gateway with a VPN attachment.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless packet filters that operate at the subnet level and cannot enforce encryption; they only allow or deny traffic based on IP addresses, ports, and protocols. Option C is wrong because AWS Direct Connect with a public VIF provides a dedicated network connection to AWS public services but does not inherently encrypt traffic between VPCs; encryption would require an additional VPN or MACsec. Option D is wrong because VPC Peering connections do not support encryption natively; security groups control traffic at the instance level but cannot enable encryption on the peering link itself.

Practice this question →
121
MCQhard

A company runs a critical application on EC2 instances behind an Application Load Balancer. They need to ensure that if an instance fails health checks, it is automatically terminated and replaced. Which AWS service should they use?

A.AWS Lambda
B.EC2 Instance Connect
C.Auto Scaling group
D.Amazon CloudWatch
AnswerC

Auto Scaling groups can use ELB health checks to automatically replace unhealthy instances.

Why this answer

An Auto Scaling group (Option C) is the correct service because it automatically replaces unhealthy EC2 instances by integrating with the Application Load Balancer's health checks. When an instance fails the configured health check (e.g., HTTP 5xx or TCP timeout), the Auto Scaling group marks it as unhealthy, terminates it, and launches a new instance to maintain the desired capacity. This lifecycle management is a core feature of Auto Scaling groups, not available in the other options.

Exam trap

The trap here is that candidates might choose Amazon CloudWatch (Option D) because they know CloudWatch can monitor health checks and trigger actions, but they overlook that CloudWatch alone cannot directly terminate and replace EC2 instances—it requires additional automation (e.g., Lambda or Auto Scaling), making Auto Scaling the correct and complete answer for automatic replacement.

How to eliminate wrong answers

Option A is wrong because AWS Lambda is a serverless compute service for running code in response to events, not for managing EC2 instance lifecycle or health check-based replacement. Option B is wrong because EC2 Instance Connect is a feature for securely connecting to EC2 instances via SSH or RDP using temporary credentials; it has no capability to terminate or replace instances based on health checks. Option D is wrong because Amazon CloudWatch is a monitoring and observability service that can trigger alarms on metrics, but it cannot directly terminate and replace EC2 instances; it would require a separate automation (e.g., Lambda) to act on the alarm, making it an indirect and incomplete solution compared to Auto Scaling groups.

Practice this question →
122
MCQmedium

A company has deployed an application across multiple AWS Regions using Application Load Balancers (ALBs). The company wants to route traffic to the nearest healthy endpoint using latency-based routing. Which AWS service should be used to distribute traffic across the ALBs?

A.Amazon CloudFront with multiple origins.
B.AWS Network Load Balancer with cross-zone load balancing.
C.Amazon Route 53 with latency routing policy.
D.AWS Global Accelerator.
AnswerC

Route 53 latency routing routes traffic based on the lowest latency between the client and the endpoint.

Why this answer

Amazon Route 53 with a latency routing policy is the correct choice because it directs traffic to the ALB endpoint that provides the lowest latency for the end user, based on measured round-trip times between the user and each AWS Region. This aligns with the requirement to route traffic to the nearest healthy endpoint using latency-based routing, as Route 53 evaluates health checks on the ALBs and only considers healthy endpoints when determining the lowest latency.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator's Anycast-based performance routing with latency-based routing, but Global Accelerator uses static IPs and the AWS backbone for geographic proximity, not real-time user-to-endpoint latency measurements like Route 53 latency policy.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront with multiple origins is a content delivery network (CDN) that caches content at edge locations and routes requests based on geographic proximity or custom origin selection, not real-time latency measurements; it does not perform latency-based routing to the nearest healthy ALB. Option B is wrong because AWS Network Load Balancer with cross-zone load balancing distributes traffic within a single Region across targets in multiple Availability Zones, but it cannot route traffic across multiple AWS Regions or select endpoints based on latency. Option D is wrong because AWS Global Accelerator uses Anycast IPs and the AWS global network to route traffic to the nearest healthy endpoint based on geographic proximity and endpoint health, but it does not use latency-based routing; it optimizes for performance via the AWS backbone, not by measuring user-to-endpoint latency.

Practice this question →
123
MCQhard

A company is troubleshooting high latency on an AWS Direct Connect connection. The network team notices that the latency increases during peak hours. The connection uses a single virtual interface (VIF) with a 1 Gbps capacity. What is the MOST likely cause of the latency?

A.The VLAN ID is mismatched between the customer router and AWS
B.The bandwidth limit of the virtual interface is being exceeded
C.Jumbo frames are not enabled on the customer router
D.BGP keepalive timers are set too high
AnswerB

Congestion causes packet drops and increased latency.

Why this answer

The most likely cause of increased latency during peak hours is that the bandwidth limit of the virtual interface (VIF) is being exceeded. When traffic approaches or surpasses the 1 Gbps capacity, the router's egress queue begins to fill, causing packet buffering and queuing delay. This queuing delay directly manifests as higher round-trip time (RTT) and is a classic symptom of link saturation.

Exam trap

The trap here is that candidates confuse bandwidth saturation with configuration errors like VLAN mismatches or MTU issues, but only saturation explains the correlation with peak hours and the gradual latency increase.

How to eliminate wrong answers

Option A is wrong because a VLAN ID mismatch would cause a complete loss of connectivity (no link state or BGP adjacency), not a gradual increase in latency during peak hours. Option C is wrong because jumbo frames (MTU 9001) reduce overhead and can improve throughput, but their absence does not cause latency to increase specifically during peak traffic; it would affect performance consistently regardless of load. Option D is wrong because BGP keepalive timers (default 60 seconds, hold time 180 seconds) control the speed of failure detection, not packet forwarding latency; setting them too high would delay route convergence but not increase per-packet delay.

Practice this question →
124
MCQeasy

A company has a VPC with an application load balancer (ALB) in public subnets and EC2 instances in private subnets. The EC2 instances must only accept traffic from the ALB. Which security group configuration achieves this?

A.Allow inbound traffic from 0.0.0.0/0 on the application port.
B.Allow inbound traffic from the VPC CIDR on the application port.
C.Allow inbound traffic from the private subnet CIDR on the application port.
D.Allow inbound traffic from the ALB's security group on the application port.
AnswerD

This ensures only traffic from the ALB is accepted.

Why this answer

Referencing the ALB's security group as the source in the EC2 instances' inbound rule ensures that only traffic originating from the ALB is allowed. This leverages AWS security group referencing, which dynamically resolves to the private IP addresses of the ALB's elastic network interfaces (ENIs), providing a secure and scalable solution without exposing the instances to broader network ranges.

Exam trap

The ANS-C01 exam often tests the misconception that allowing traffic from the VPC CIDR or private subnet CIDR is sufficient, but the trap here is that those rules are too broad and do not restrict traffic exclusively to the ALB, which is a common oversight when candidates confuse network-level access with application-level access.

How to eliminate wrong answers

Option A is wrong because allowing inbound traffic from 0.0.0.0/0 on the application port would permit any internet host to reach the EC2 instances, bypassing the ALB and violating the requirement. Option B is wrong because allowing inbound traffic from the VPC CIDR would permit any resource within the VPC (including other EC2 instances, NAT gateways, or services) to access the instances, not just the ALB. Option C is wrong because allowing inbound traffic from the private subnet CIDR would permit any instance in the private subnets to reach the EC2 instances, which is overly permissive and does not restrict traffic solely to the ALB.

Practice this question →
125
MCQmedium

A company is implementing a multi-region active-active application. They want to route users to the nearest healthy endpoint using DNS. Which AWS service should be used?

A.Elastic Load Balancer (ELB)
B.Amazon CloudFront
C.Amazon Route 53 latency-based routing
D.AWS Global Accelerator
AnswerC

Routes based on lowest latency.

Why this answer

Amazon Route 53 latency-based routing directs traffic based on the lowest network latency between the user and the endpoint, making it ideal for routing users to the nearest healthy endpoint in a multi-region active-active setup. It continuously monitors endpoint health via health checks and only routes to healthy endpoints, ensuring high availability and performance.

Exam trap

The trap here is that candidates confuse AWS Global Accelerator (which also routes to the nearest healthy endpoint) with DNS-based routing, but Global Accelerator uses Anycast at the network layer, not DNS, so it does not meet the 'using DNS' requirement specified in the question.

How to eliminate wrong answers

Option A is wrong because Elastic Load Balancer (ELB) operates within a single AWS region and cannot route traffic across multiple regions based on user proximity or latency. Option B is wrong because Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations and does not perform DNS-based routing to the nearest healthy application endpoint; it is designed for static and dynamic content acceleration, not for active-active multi-region routing. Option D is wrong because AWS Global Accelerator uses Anycast IPs and the AWS global network to route traffic to the nearest healthy endpoint, but it operates at the network layer (Layer 3/4) and is not a DNS-based routing service; the question specifically asks for DNS-based routing, which is a key differentiator.

Practice this question →
126
Multi-Selecthard

Which THREE components are required to establish a site-to-site VPN connection between an on-premises network and AWS? (Choose THREE.)

Select 3 answers
A.AWS Direct Connect
B.AWS Transit Gateway
C.Virtual Private Gateway
D.Customer Gateway
E.VPN Connection
AnswersC, D, E

AWS side VPN endpoint.

Why this answer

A Virtual Private Gateway (VGW) is required as the AWS-side VPN concentrator for a site-to-site VPN connection. It attaches to a VPC and terminates the IPsec tunnels from the on-premises network, enabling encrypted traffic between the VPC and the remote network.

Exam trap

The trap here is that candidates often confuse optional components like Transit Gateway or Direct Connect as mandatory for a site-to-site VPN, when in fact only the VGW, CGW, and VPN Connection are strictly required.

Practice this question →
127
Multi-Selecteasy

Which THREE of the following are considerations when designing a Direct Connect implementation for high availability? (Choose three.)

Select 3 answers
A.Use a single connection with high bandwidth.
B.Configure static routes to the on-premises network.
C.Use BGP to advertise the same prefixes over both connections.
D.Use two or more Direct Connect connections.
E.Connect to different Direct Connect locations.
AnswersC, D, E

Enables automatic failover.

Why this answer

Using BGP to advertise the same prefixes over both Direct Connect connections enables active-active or active-passive load balancing and automatic failover. BGP’s route selection and AS_PATH prepending allow you to control traffic flow, ensuring that if one connection fails, the other continues to advertise the same prefixes, maintaining connectivity without manual intervention.

Exam trap

The ANS-C01 exam often tests the misconception that high bandwidth alone or static routes provide high availability, but the key is dynamic routing with BGP and redundant physical connections to separate locations.

Practice this question →
128
MCQmedium

A company has a VPC with an IPv6 CIDR and wants to provide internet access to instances in a private subnet using IPv6. Which AWS service should be used?

A.VPC Gateway Endpoint
B.Internet Gateway
C.NAT Gateway
D.Egress-Only Internet Gateway
AnswerD

Egress-only internet gateway provides outbound-only IPv6 access.

Why this answer

An Egress-Only Internet Gateway (EIGW) is the correct AWS service for providing outbound-only IPv6 internet access to instances in a private subnet. Unlike IPv4, IPv6 addresses are globally unique and publicly routable by default, so a NAT-like translation is unnecessary; the EIGW allows outbound traffic while preventing unsolicited inbound connections, aligning with the private subnet's security posture.

Exam trap

The trap here is that candidates confuse the Egress-Only Internet Gateway with a NAT Gateway, mistakenly thinking IPv6 requires address translation, or they select the Internet Gateway without realizing it would expose private instances to inbound IPv6 traffic.

How to eliminate wrong answers

Option A is wrong because a VPC Gateway Endpoint provides private connectivity to AWS services (e.g., S3, DynamoDB) over the AWS network, not internet access. Option B is wrong because an Internet Gateway enables bidirectional IPv6 traffic; attaching it to a private subnet would allow inbound connections from the internet, violating the requirement for a private subnet. Option C is wrong because a NAT Gateway supports only IPv4 traffic; it cannot process IPv6 packets and is irrelevant for IPv6 internet access.

Practice this question →
129
MCQhard

A company has a VPC with public and private subnets in two Availability Zones. They have a NAT gateway in each AZ for outbound internet access. They recently added a third AZ and created a new private subnet. Instances in the new private subnet cannot reach the internet. The route table for the new subnet has a default route (0.0.0.0/0) pointing to a NAT gateway in the same AZ. What is the most likely cause?

A.The security group attached to the NAT gateway blocks outbound traffic
B.The route table in the new private subnet does not have a route to the NAT gateway
C.The NAT gateway in the new AZ does not have an Elastic IP address attached
D.The NAT gateway is not in a public subnet in the new AZ
AnswerC

A NAT gateway requires an Elastic IP to function; without it, outbound traffic fails.

Why this answer

A NAT gateway requires an Elastic IP (EIP) address to function for outbound internet traffic. Without an EIP attached, the NAT gateway cannot translate private source IPs to a public IP, so instances in the new private subnet cannot reach the internet even though the route table correctly points to the NAT gateway in the same AZ.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT gateway only needs a route to the internet gateway, but the trap here is that candidates overlook the mandatory Elastic IP attachment, which is a prerequisite for the NAT gateway to function as an internet-facing device.

How to eliminate wrong answers

Option A is wrong because security groups are not attached to NAT gateways; they are attached to ENIs (elastic network interfaces) of instances, and NAT gateways are managed services that do not use security groups—instead, network ACLs on the subnet control traffic. Option B is wrong because the route table in the new private subnet already has a default route (0.0.0.0/0) pointing to the NAT gateway, so the route exists; the issue is not a missing route but the NAT gateway's lack of an EIP. Option D is wrong because while a NAT gateway must reside in a public subnet (with a route to an internet gateway), the question states the NAT gateway is in the same AZ, implying it is in a public subnet; the core problem is the missing EIP, not the subnet type.

Practice this question →
130
Multi-Selecteasy

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. Which TWO actions should be taken to ensure high availability?

Select 2 answers
A.Use a Network Load Balancer instead of an ALB.
B.Register EC2 instances in multiple Availability Zones.
C.Place the EC2 instances in a single Availability Zone.
D.Configure the ALB as internal.
E.Configure the ALB as internet-facing.
AnswersB, E

Multi-AZ provides fault tolerance.

Why this answer

Registering EC2 instances in multiple Availability Zones ensures that if one AZ becomes unavailable, the ALB can route traffic to healthy instances in another AZ. This is a fundamental requirement for high availability because the ALB distributes incoming traffic across targets in different AZs, and if all instances are in a single AZ, that AZ becomes a single point of failure.

Exam trap

The ANS-C01 exam often tests the misconception that using a Network Load Balancer instead of an Application Load Balancer improves high availability, but the trap is that high availability depends on distributing targets across multiple AZs, not on the load balancer type, and the question explicitly requires an ALB for Layer 7 features.

Practice this question →
131
MCQmedium

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The company wants to centralize network security by inspecting all traffic between VPCs and between VPCs and on-premises. Which architecture should be used?

A.Attach all VPCs to a Transit Gateway and use route tables to send traffic through a firewall appliance in one VPC.
B.Use VPN connections between all VPCs and on-premises.
C.Use VPC peering between all VPCs and configure security groups.
D.Use Network Load Balancer to distribute traffic across VPCs.
AnswerA

Transit Gateway route tables can direct traffic to a inspection VPC.

Why this answer

AWS Transit Gateway supports centralized routing through a shared services VPC. By attaching all VPCs and VPN connections to the Transit Gateway and configuring route tables to point default or inter-VPC routes to a network firewall appliance (e.g., a third-party firewall or AWS Network Firewall) in a dedicated inspection VPC, all traffic between VPCs and between VPCs and on-premises can be forced through the firewall for inspection. This architecture leverages Transit Gateway route tables and blackhole routes to enforce traffic steering without requiring complex peering or VPN meshes.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering or VPN meshes can achieve centralized inspection, but the trap is that only Transit Gateway with a dedicated inspection VPC provides transitive routing and a single point of policy enforcement without requiring a full mesh of connections.

How to eliminate wrong answers

Option B is wrong because using VPN connections between all VPCs and on-premises creates a full-mesh VPN topology that does not centralize inspection; each VPN tunnel would require separate routing and firewall policies, and traffic between VPCs would not be inspected unless routed through an additional appliance. Option C is wrong because VPC peering does not support transitive routing; to inspect traffic between all VPCs, you would need a full mesh of peering connections and manual routing through a firewall in each VPC, which is unscalable and does not centralize inspection. Option D is wrong because a Network Load Balancer distributes traffic at Layer 4 and does not provide routing or inspection capabilities; it cannot force traffic through a firewall or make forwarding decisions between VPCs or to on-premises.

Practice this question →
132
MCQhard

Refer to the exhibit. A network engineer is creating an IAM policy for a junior engineer who needs to set up a VPC with public and private subnets and an internet gateway. The junior engineer reports that they cannot create a VPC peering connection. Based on the policy, what is the most likely reason?

A.The policy has an explicit Deny statement for ec2:CreateVpcPeeringConnection.
B.The policy allows ec2:CreateVpc which implicitly denies peering.
C.The policy requires multi-factor authentication to create VPC peering connections.
D.The policy does not allow the ec2:CreateVpcPeeringConnection action.
AnswerA

The explicit Deny overrides any Allow and prevents the action.

Why this answer

The policy includes an explicit Deny statement for the ec2:CreateVpcPeeringConnection action. In IAM, an explicit Deny overrides any Allow, so even though the policy allows other VPC-related actions, the Deny prevents the junior engineer from creating VPC peering connections. Therefore, the most likely reason is that the policy has an explicit Deny for that action, which corresponds to option A.

Option B is incorrect because the policy does allow ec2:CreateVpc and does not implicitly deny peering; an explicit Deny is required. Option C is irrelevant because the policy does not mention MFA. Option D is incorrect because the policy does not allow the action, but the explicit Deny is the stronger reason and is listed as option A.

Practice this question →
133
MCQhard

A company has a Direct Connect connection with a private VIF to a VPC in us-east-1. The VPC has two subnets: a public subnet and a private subnet. The public subnet has an internet gateway attached. The private subnet has a NAT gateway. The company's on-premises network uses the 10.0.0.0/8 IP range. The VPC CIDR is 10.1.0.0/16. The on-premises router is advertising 10.1.0.0/16 over BGP to the Direct Connect router. The company needs EC2 instances in the private subnet to initiate outbound connections to the internet for updates. The NAT gateway is in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, the on-premises network team reports that they can ping the private IP of the NAT gateway (10.1.0.10) but not the private IP of an EC2 instance in the private subnet (10.1.1.50). The EC2 instance's security group allows ICMP from the on-premises IP range. The VPC's main route table has a route for 10.0.0.0/8 pointing to the virtual private gateway. The VPC is attached to a virtual private gateway. What is the most likely cause?

A.The virtual private gateway is not attached to the VPC.
B.The NAT gateway is not reachable from the on-premises network.
C.The security group on the EC2 instance is blocking ICMP from the on-premises IP range.
D.The private subnet's route table does not have a route for the on-premises CIDR (10.0.0.0/8) pointing to the virtual private gateway.
AnswerD

Without a route for the on-premises CIDR in the private subnet's route table, traffic from on-premises to the EC2 instance is not forwarded to the VGW.

Why this answer

The on-premises network can ping the NAT gateway because the NAT gateway is in the public subnet, and the route table for the public subnet likely has a route to the virtual private gateway for the on-premises CIDR. However, the EC2 instance is in the private subnet, and the private subnet's route table does not have a route for the on-premises CIDR (10.0.0.0/8) pointing to the virtual private gateway. The VPC's main route table has such a route, but the private subnet is not using the main route table; it likely has a custom route table that only has the default route to the NAT gateway.

Therefore, traffic from on-premises to the EC2 instance's private IP is not routed to the virtual private gateway. Option D is correct. Option A is incorrect because the security group allows ICMP.

Option B is incorrect because the NAT gateway is reachable. Option C is incorrect because the virtual private gateway is attached.

Practice this question →
134
Multi-Selecteasy

A company is deploying an application across multiple VPCs using AWS Transit Gateway. They need to ensure that only specific VPCs can communicate with each other. Which TWO methods can be used to isolate traffic?

Select 2 answers
A.Use Transit Gateway Network Manager to create a network segmentation design.
B.Create separate Transit Gateway route tables for different groups of VPCs and associate the VPC attachments accordingly.
C.Configure network ACLs on the VPC subnets to allow or deny traffic.
D.Use security groups on the Transit Gateway attachments.
E.Implement VPC endpoints for inter-VPC communication.
AnswersA, B

Network Manager helps visualize and manage segmentation.

Why this answer

Transit Gateway Network Manager provides a centralized view and allows you to create network segmentation designs by grouping resources and defining routing policies, which helps isolate traffic between specific VPCs. Option B is correct because by creating separate Transit Gateway route tables for different groups of VPCs and associating VPC attachments accordingly, you control which VPCs can route traffic to each other, effectively isolating traffic between groups.

Exam trap

The trap here is that candidates often confuse network ACLs or security groups as mechanisms for inter-VPC traffic control, but these operate within a VPC and cannot be applied to Transit Gateway attachments, which require route table segmentation for isolation.

Practice this question →
135
Multi-Selectmedium

Which TWO of the following are valid methods to connect multiple VPCs in the same AWS region using AWS native services? (Choose two.)

Select 2 answers
A.Software VPN appliance
B.VPC peering
C.AWS Direct Connect
D.Amazon ClassicLink
E.AWS Transit Gateway
AnswersB, E

Native service for VPC-to-VPC connectivity.

Why this answer

VPC peering (B) is a valid AWS-native method to connect multiple VPCs in the same region, using the AWS backbone to route traffic between VPCs via private IPv4 or IPv6 addresses with no single point of failure or bandwidth bottleneck. AWS Transit Gateway (E) is also a native service that acts as a hub-and-spoke router, enabling transitive connectivity between thousands of VPCs and on-premises networks using a single gateway, supporting both same-region and inter-region peering attachments.

Exam trap

The ANS-C01 exam often tests the misconception that AWS Direct Connect can directly interconnect VPCs, but it is a physical connection to on-premises only, not a VPC-to-VPC connectivity method.

Practice this question →
136
MCQmedium

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The VPC has a virtual private gateway (VGW). The on-premises network uses BGP to exchange routes with the VGW. The company wants to route traffic from the VPC to an on-premises subnet 192.168.1.0/24. The on-premises router advertises 192.168.1.0/24 over BGP. However, instances in the VPC cannot reach that subnet. The VPC route table has the local route and a route to the VGW for 0.0.0.0/0. What is the most likely cause?

A.BGP route propagation is disabled on the VPC route table
B.The 192.168.1.0/24 subnet overlaps with the VPC CIDR, causing the local route to take precedence
C.The VPC route table does not have a specific route for 192.168.1.0/24 pointing to the virtual private gateway
D.The Direct Connect virtual interface does not have the allowed prefixes configured
AnswerB

Local routes have higher priority than propagated routes.

Why this answer

If the on-premises subnet 192.168.1.0/24 overlaps with the VPC CIDR (e.g., VPC CIDR 192.168.0.0/16), the VPC's local route takes precedence over any propagated BGP routes. Traffic destined for 192.168.1.0/24 stays within the VPC and never reaches the virtual private gateway, even though the on-premises router is advertising the route. Option A is incorrect because BGP route propagation is enabled by default for Direct Connect private VIFs, and even if disabled, a static route to the VGW would be needed.

Option C is incorrect because if the subnet overlaps, a specific route to the VGW would be ignored due to the local route's higher priority. Option D is incorrect because allowed prefixes are configured on the Direct Connect gateway, not the VIF, and the route is being advertised successfully.

Practice this question →
137
MCQeasy

A company wants to restrict outbound traffic from a VPC to only allow HTTPS traffic to a specific list of domains. Which AWS service can be used to achieve this?

A.AWS Network Firewall
B.Security groups
C.Amazon Route 53
D.Application Load Balancer
AnswerA

Network Firewall can filter outbound traffic by domain name using stateful rules.

Why this answer

AWS Network Firewall is the correct choice because it provides stateful, managed firewall rules that can inspect and filter outbound traffic based on domain names (FQDN) for HTTPS (port 443) using TLS inspection or domain list rules. This allows you to create a rule group that permits outbound HTTPS traffic only to a specified list of domains, while blocking all other outbound traffic.

Exam trap

The ANS-C01 exam often tests the misconception that security groups can filter by domain names because they are stateful and support DNS names in rules, but in reality, security groups only support IP-based rules and cannot resolve or filter by FQDNs.

How to eliminate wrong answers

Option B is wrong because security groups are stateful and can only filter traffic based on IP addresses, CIDR blocks, or other security groups; they cannot filter by domain names or FQDNs. Option C is wrong because Amazon Route 53 is a DNS service that resolves domain names to IP addresses; it does not perform traffic filtering or firewall functions. Option D is wrong because an Application Load Balancer distributes incoming traffic to targets and can terminate TLS, but it is not designed to filter outbound traffic from a VPC or restrict traffic based on domain names.

Practice this question →
138
MCQeasy

A company needs to connect its on-premises data center to AWS using a site-to-site VPN. The on-premises firewall does not support IPsec. What alternative solution can the company use?

A.Create a VPC peering connection between the on-premises router and the VPC.
B.Use AWS Client VPN to establish a VPN connection from the on-premises network.
C.Deploy an AWS Transit Gateway and attach the on-premises network via a VPC attachment.
D.Use AWS Direct Connect to establish a dedicated physical link.
AnswerB

Client VPN can terminate on a firewall running OpenVPN.

Why this answer

AWS Client VPN is a managed, OpenVPN-based service that allows on-premises clients to securely access AWS resources without requiring IPsec support on the on-premises firewall. Since the firewall does not support IPsec, Client VPN provides an alternative by using TLS-based VPN tunnels that only require standard TCP/UDP ports (typically 443) to be open, making it compatible with nearly any firewall.

Exam trap

The ANS-C01 exam often tests the misconception that any VPN requires IPsec, but AWS Client VPN uses TLS-based tunnels (OpenVPN) as an alternative when the on-premises device lacks IPsec support.

How to eliminate wrong answers

Option A is wrong because VPC peering connects two VPCs within AWS and cannot extend to an on-premises router; it is not a VPN or hybrid connectivity solution. Option C is wrong because an AWS Transit Gateway VPC attachment connects a VPC to the Transit Gateway, not an on-premises network; the on-premises network would still need an IPsec VPN or Direct Connect to attach to the Transit Gateway. Option D is wrong because AWS Direct Connect requires a dedicated physical link from the on-premises data center to an AWS Direct Connect location, which does not solve the firewall's lack of IPsec support and involves significant physical infrastructure and lead time.

Practice this question →
139
Multi-Selectmedium

A company has a VPC with public and private subnets. They have a NAT gateway in a public subnet for outbound internet access from private instances. Which TWO of the following are required for the NAT gateway to function correctly?

Select 2 answers
A.The NAT gateway is deployed in a private subnet
B.A security group attached to the NAT gateway
C.A route in the public subnet's route table to an internet gateway
D.A network ACL attached to the NAT gateway's subnet that allows inbound traffic from the internet
E.An Elastic IP address assigned to the NAT gateway
AnswersC, E

The NAT gateway must be in a public subnet with internet access.

Why this answer

A NAT gateway must be placed in a public subnet and requires an Elastic IP address (E) to enable outbound internet traffic with a source IP that can be routed back. Additionally, the public subnet where the NAT gateway resides must have a route in its route table that points to an internet gateway (C) for the NAT gateway to reach the internet. Security groups are not attached to NAT gateways (they use security groups for attached instances, but NAT gateways themselves are not security group–aware).

Network ACLs control traffic at the subnet level but are not a requirement specific to NAT gateway functionality; they can be configured as needed. Deploying the NAT gateway in a private subnet (A) would prevent it from accessing the internet because private subnets do not have direct routes to an internet gateway. Therefore, only options C and E are required.

Practice this question →
140
Multi-Selecthard

A company has a VPC with a CIDR of 10.0.0.0/16. They have two Availability Zones, each with a public and a private subnet. They want to connect their on-premises network (192.168.0.0/16) to the VPC using a site-to-site VPN. Which THREE resources are needed to establish the VPN connection? (Choose THREE.)

Select 3 answers
A.Customer Gateway
B.AWS Direct Connect
C.VPN Connection
D.AWS Transit Gateway
E.Virtual Private Gateway
AnswersA, C, E

Required to represent the on-premises router.

Why this answer

A Customer Gateway (option A) is required because it represents the on-premises VPN device in AWS, providing the public IP address and routing information needed to establish the IPsec tunnel. A VPN Connection (option C) is the logical resource that ties together the Customer Gateway and the Virtual Private Gateway, defining the tunnel settings, pre-shared keys, and routing options. A Virtual Private Gateway (option E) is the AWS-side endpoint attached to the VPC that terminates the VPN tunnels and routes traffic between the VPC and the on-premises network.

Exam trap

The trap here is that candidates often confuse AWS Transit Gateway as a mandatory component for VPNs, but it is only needed when connecting multiple VPCs or VPNs centrally, not for a single VPC-to-on-premises VPN.

Practice this question →
141
MCQmedium

A network engineer runs the above command and sees an ENI (eni-0a1b2c3d4e5f6g7h8) with status 'in-use' but no InstanceId attached. What AWS service is most likely using this ENI?

A.A VPC endpoint (Interface type).
B.An Amazon RDS database instance.
C.A NAT gateway.
D.An AWS Transit Gateway.
AnswerB

RDS uses managed ENIs with 'RDS-managed' description.

Why this answer

An Amazon RDS database instance uses an Elastic Network Interface (ENI) as its primary network interface, and when the RDS instance is in a 'stopped' or 'failed' state, the ENI may remain in 'in-use' status without an InstanceId attached. This is because RDS manages its own ENI independently of EC2 instances, and the ENI persists even when the database instance is not running.

Exam trap

The ANS-C01 exam often tests the misconception that an ENI in 'in-use' status must always be attached to an EC2 instance, leading candidates to overlook managed services like RDS that use ENIs without exposing the InstanceId.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint (Interface type) creates an ENI with a specific service name and typically shows an 'available' status when not attached to an instance, not 'in-use' without an InstanceId. Option C is wrong because a NAT gateway uses an ENI that is always associated with the NAT gateway resource itself, and the ENI will show the NAT gateway's ID in the description or attachment, not a missing InstanceId. Option D is wrong because an AWS Transit Gateway does not use ENIs directly; it operates at the VPC attachment level using transit gateway attachments, not individual ENIs.

Practice this question →
142
MCQhard

A network engineer examines the route table above. The VPC has a CIDR of 10.0.0.0/16. There is a VPC peering connection (pcx-...) to a VPC with CIDR 192.168.0.0/16. However, instances in this route table's subnet cannot communicate with the peered VPC. What is the most likely cause?

A.The route table is not associated with the subnet.
B.The VPC peering connection is in 'pending-acceptance' state.
C.The security group or network ACL in the source subnet is blocking traffic.
D.The route to the peered VPC is missing from the route table.
AnswerC

Even with correct routing, security groups/NACLs can block traffic.

Why this answer

The route table shown includes a route for the peered VPC (192.168.0.0/16 via pcx-...), and the route table is associated with the subnet (implied by the question stating 'this route table's subnet'). Since routing is in place, the most likely remaining cause is that a security group (stateful, blocking inbound/outbound traffic) or a network ACL (stateless, blocking inbound/outbound traffic) is filtering the traffic between the subnets. Security groups and network ACLs operate at the instance and subnet level respectively, and misconfigured rules can prevent communication even when routes are correct.

Exam trap

The ANS-C01 exam often tests the misconception that a missing route is the only cause for VPC peering communication failure, but the trap here is that the route is present, so candidates must consider security group or network ACL filtering as the next most likely cause.

How to eliminate wrong answers

Option A is wrong because the question explicitly states 'instances in this route table's subnet', which implies the route table is associated with the subnet; if it were not associated, the subnet would use the main route table, and the engineer would not be examining this specific route table. Option B is wrong because if the VPC peering connection were in 'pending-acceptance' state, the route would not be in the route table (the route is only added after acceptance), and the question shows the route is present, so the connection must be in 'active' state. Option D is wrong because the route table shown includes a route for 192.168.0.0/16 with the peering connection as target, so the route is not missing; the issue lies elsewhere.

Practice this question →
143
Multi-Selectmedium

Which TWO statements about AWS Direct Connect are correct? (Select TWO.)

Select 2 answers
A.Direct Connect traffic is encrypted by default
B.Direct Connect supports multiple virtual interfaces (VIFs) over a single connection
C.Direct Connect is a managed VPN service
D.Direct Connect can be provisioned in minutes without any physical infrastructure
E.Direct Connect provides a consistent network experience with lower latency and higher bandwidth than internet-based VPN
AnswersB, E

You can have public, private, and transit VIFs.

Why this answer

AWS Direct Connect allows you to create multiple virtual interfaces (VIFs) — including private VIFs, public VIFs, and transit VIFs — over a single physical Direct Connect connection. This enables you to segment traffic to different AWS services (e.g., VPCs via private VIF, public AWS endpoints via public VIF) without needing separate physical cables, leveraging 802.1Q VLAN tagging to isolate each VIF.

Exam trap

The trap here is that candidates confuse Direct Connect's private, dedicated nature with inherent encryption, but AWS explicitly states that encryption is optional and must be added by the customer (e.g., using IPsec or TLS).

Practice this question →
144
MCQhard

A company has an AWS Direct Connect connection with a private VIF to a VPC. They also have a VPN connection as a backup. They want to use BGP attributes to prefer the Direct Connect path. On the customer router, they set a lower local preference for routes received via the VPN. However, traffic still uses the VPN. What could be the reason?

A.Local preference is not supported by AWS for BGP sessions; use AS path prepending instead
B.The weight attribute is set higher on the VPN routes
C.Bidirectional Forwarding Detection (BFD) is not enabled on the Direct Connect connection
D.The BGP MED attribute is not set on the VPN routes
AnswerA

AWS does not accept local preference; AS path prepending is used to influence outbound traffic.

Why this answer

AWS does not honor the local preference attribute set on the customer router for routes received via the VPN. In AWS, BGP local preference is not considered; instead, AS path prepending is the standard method to influence route selection on the customer side. Option B is incorrect because weight is a Cisco-proprietary attribute that is not used in AWS BGP sessions.

Option C is incorrect because BFD is used for fast failure detection, not path selection. Option D is incorrect because MED is used to influence inbound traffic from AWS, not to prefer the Direct Connect path on the customer router.

Practice this question →
145
Multi-Selecteasy

Which TWO of the following are valid methods to connect an on-premises data center to a VPC in AWS? (Choose 2.)

Select 2 answers
A.AWS Direct Connect
B.VPC endpoint
C.Transit Gateway
D.AWS Site-to-Site VPN
E.VPC peering
AnswersA, D

Direct Connect provides a dedicated private connection.

Why this answer

AWS Direct Connect is a correct answer because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet for consistent latency and higher bandwidth. This service uses industry-standard 802.1Q VLANs to create virtual interfaces, enabling direct access to VPCs via private virtual interfaces (VIFs) or transit virtual interfaces for use with Transit Gateway.

Exam trap

The ANS-C01 exam often tests the distinction between connectivity services and routing constructs, so the trap here is that candidates may confuse Transit Gateway (a routing hub) with a direct connection method, or think VPC peering can extend on-premises connectivity, when it only works between VPCs within AWS.

Practice this question →
146
MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. The VPC has a subnet that hosts an EC2 instance with a sensitive database. The company wants to add an extra layer of encryption for traffic between the on-premises network and the EC2 instance. Which solution should be used?

A.Enable TLS on the EC2 instance
B.Use an SSL certificate on the on-premises router
C.Use AWS Key Management Service (KMS) to encrypt the traffic
D.Set up an IPsec VPN tunnel over the Direct Connect private VIF
AnswerD

IPsec VPN provides encryption at the network layer over the Direct Connect connection.

Why this answer

An IPsec VPN tunnel over a Direct Connect private VIF adds an extra layer of encryption to traffic between on-premises and the EC2 instance. Direct Connect private VIFs provide a private, isolated connection but do not encrypt data by default; IPsec encrypts the IP payload at Layer 3, ensuring confidentiality over the physical link. This meets the requirement for an additional encryption layer without altering the application or network stack on the EC2 instance.

Exam trap

The ANS-C01 exam often tests the misconception that Direct Connect private VIFs are inherently encrypted, leading candidates to overlook the need for an additional encryption layer like IPsec, or they confuse encryption at rest (KMS) with encryption in transit.

How to eliminate wrong answers

Option A is wrong because enabling TLS on the EC2 instance only encrypts application-layer traffic (e.g., HTTPS) and does not encrypt all IP traffic between on-premises and the instance; it also requires application support and does not cover non-TLS protocols. Option B is wrong because an SSL certificate on the on-premises router is used for authentication and encryption in SSL/TLS sessions, but it does not create a secure tunnel for all traffic; it is typically used for HTTPS inspection or VPN termination, not for encrypting a Direct Connect VIF. Option C is wrong because AWS Key Management Service (KMS) is a key management service for encrypting data at rest (e.g., EBS volumes, S3 objects) and cannot encrypt network traffic in transit; it does not provide a mechanism to encrypt IP packets flowing over a Direct Connect connection.

Practice this question →
147
MCQhard

A company is migrating its on-premises data center to AWS and wants to extend its Layer 2 network to AWS using AWS Outposts. The company has an existing VLAN with IP subnet 10.0.1.0/24 that hosts a legacy application requiring direct Layer 2 connectivity between on-premises servers and Outposts racks. The network engineer has installed an Outposts rack in the data center and connected it to the on-premises network via a local gateway (LGW) with a VLAN interface. The engineer has created a subnet in the Outposts VPC with CIDR 10.0.1.0/24 and launched EC2 instances. However, the on-premises servers cannot communicate with the Outposts instances. The LGW is configured correctly. Which action should the engineer take to resolve the issue?

A.Configure the LGW VLAN interface with the correct VLAN ID that matches the on-premises VLAN.
B.Create a VPC peering connection between the Outposts VPC and the on-premises network via the LGW.
C.Set up a Direct Connect private virtual interface from the on-premises router to the Outposts VPC.
D.Attach the Outposts VPC to a Transit Gateway and peer with on-premises network.
AnswerA

The VLAN ID must match for Layer 2 connectivity.

Why this answer

The LGW VLAN interface must be configured with the same VLAN ID as the on-premises VLAN to allow Layer 2 communication. Option B is incorrect because a VPC peering connection operates at Layer 3, not Layer 2. Option C is incorrect because Direct Connect is not required for this Layer 2 extension.

Option D is incorrect because a Transit Gateway does not provide Layer 2 extension.

Practice this question →
148
MCQeasy

A company needs to provide internet access to a VPC that has both public and private subnets. They have already created an Internet Gateway and attached it to the VPC. What else must be configured for instances in the public subnet to be reachable from the internet?

A.Launch a NAT Gateway in the public subnet.
B.Add a route to the public subnet's route table pointing 0.0.0.0/0 to the Internet Gateway.
C.Attach the VPC to an AWS Transit Gateway.
D.Establish a VPN connection to the Internet Gateway.
AnswerB

This enables traffic to flow between the subnet and the internet.

Why this answer

For instances in a public subnet to be reachable from the internet, the subnet's route table must include a default route (0.0.0.0/0) pointing to the Internet Gateway (IGW). The IGW itself is a horizontally scaled, redundant component that provides a target for internet-bound traffic, but without the route, traffic from the internet cannot reach the instances. This route enables bidirectional communication: the IGW performs NAT for instances with public IPs, translating their private IPs to the associated Elastic IP or public IP.

Exam trap

The trap here is that candidates often confuse the purpose of a NAT Gateway (outbound-only) with the requirement for inbound internet reachability, mistakenly thinking a NAT Gateway is needed for public subnet instances, when in fact a route to the IGW is the only missing piece.

How to eliminate wrong answers

Option A is wrong because a NAT Gateway is used to provide outbound internet access to instances in private subnets, not to make instances in public subnets reachable from the internet; it does not allow inbound connections initiated from the internet. Option C is wrong because an AWS Transit Gateway is a network transit hub used to interconnect VPCs and on-premises networks, not to provide internet access to a VPC; it does not replace the need for an IGW and a route to it. Option D is wrong because a VPN connection is used for secure site-to-site connectivity between on-premises networks and a VPC, not for direct internet access; the Internet Gateway is the correct attachment point for internet traffic, and a VPN cannot be established to an IGW.

Practice this question →
149
Multi-Selecthard

An organization is designing a hybrid network using AWS Direct Connect with a private VIF. They want to ensure high availability and failover. Which THREE components should be part of the design?

Select 3 answers
A.A NAT gateway in each Availability Zone.
B.Two separate Direct Connect connections from different providers or locations.
C.BGP with multiple sessions and AS-path prepending for route preference.
D.A VPN connection as a backup to the Direct Connect.
E.A single Direct Connect connection with multiple VLANs.
AnswersB, C, D

Redundant physical connections prevent a single point of failure.

Why this answer

Using two separate Direct Connect connections from different providers or locations ensures physical diversity, eliminating single points of failure. This design meets the high availability requirement by providing redundant paths for traffic, even if one connection or provider experiences an outage.

Exam trap

The trap here is that candidates often think a single Direct Connect connection with multiple VLANs provides redundancy, but VLANs only separate traffic logically and do not protect against physical link failure, so multiple physical connections are required for true high availability.

Practice this question →
150
MCQmedium

A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet with a private IP only. The instance needs to download patches from the internet. Which configuration is required?

A.Launch a NAT instance in the private subnet and configure source/destination check.
B.Create a VPC endpoint for the patch service.
C.Create a NAT gateway in the public subnet and add a default route to the NAT gateway in the private subnet's route table.
D.Attach an internet gateway to the VPC and add a default route to it in the private subnet's route table.
AnswerC

NAT gateway enables outbound internet access for private instances while preventing inbound traffic.

Why this answer

A NAT gateway in the public subnet provides outbound internet access for instances in the private subnet while preventing inbound connections from the internet. By adding a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT gateway, traffic from the EC2 instance destined for the internet is forwarded to the NAT gateway, which then uses its Elastic IP to communicate with the internet. This allows the instance to download patches without requiring a public IP or direct internet gateway access.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT instance or gateway can be placed in a private subnet, but the key trap is that NAT devices must reside in a public subnet with an internet gateway route to function correctly for outbound internet access.

How to eliminate wrong answers

Option A is wrong because launching a NAT instance in the private subnet would not allow outbound internet access, as the private subnet has no direct path to the internet; NAT instances must be placed in a public subnet with an internet gateway route. Option B is wrong because a VPC endpoint for the patch service is not a general solution—it only works if the patch service is an AWS service (e.g., Systems Manager) and does not provide internet access for arbitrary patch repositories. Option D is wrong because attaching an internet gateway to the VPC and adding a default route to it in the private subnet's route table would expose the private instance directly to the internet, violating the private subnet's isolation and bypassing NAT, which is not a secure or valid configuration.

Practice this question →
← PreviousPage 2 of 6 · 416 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Network Implementation questions.

Start 20-question session