CCNA Network Implementation Questions — Page 3 of 6

151

MCQmedium

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise its prefixes. Recently, the on-premises router started advertising a more specific route (10.0.0.0/24) that overlaps with the VPC's CIDR (10.0.0.0/16). What is the impact on traffic destined to 10.0.0.5?

A.The instance becomes unreachable from on-premises.

B.Return traffic from the instance to on-premises is routed through Direct Connect instead of staying within the VPC.

C.Traffic destined to the instance is blackholed.

D.Traffic is load-balanced between the VPC and Direct Connect.

AnswerB

More specific route is preferred.

Why this answer

When an on-premises router advertises a more specific route (10.0.0.0/24) via BGP over a Direct Connect private VIF, the VPC propagates this route into its route tables. For traffic destined to 10.0.0.5, the VPC now has a more specific route (10.0.0.0/24) pointing to the virtual private gateway (VGW), overriding the local VPC route (10.0.0.0/16). This causes return traffic from the instance to on-premises to be routed through Direct Connect instead of staying within the VPC, as the VPC's route table prefers the longest prefix match.

Exam trap

The ANS-C01 exam often tests the misconception that a more specific BGP route will cause the instance to become unreachable or blackholed, but the actual impact is asymmetric routing where return traffic is forced out through Direct Connect.

How to eliminate wrong answers

Option A is wrong because the instance remains reachable from on-premises; the on-premises router can still send traffic to 10.0.0.5 via the Direct Connect connection, and the VPC will forward it locally. Option C is wrong because traffic is not blackholed; the more specific route directs traffic to the VGW, which forwards it to the on-premises network, so packets are not dropped. Option D is wrong because there is no load-balancing; the VPC route table selects a single path based on the longest prefix match, and the more specific route (10.0.0.0/24) takes precedence over the local VPC route (10.0.0.0/16).

Practice this question →

152

Matchingmedium

Match each AWS security feature to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Stateful firewall that controls inbound and outbound traffic at instance level

Stateless firewall that controls traffic at subnet level

Web application firewall that protects against common web exploits

Managed DDoS protection service with enhanced detection and mitigation

Managed firewall service that provides stateful inspection for VPC traffic

Why these pairings

These are core security services for network protection. Security Groups are instance-level, NACLs are subnet-level, WAF protects web apps, and Shield provides DDoS protection.

Practice this question →

153

Multi-Selectmedium

Which TWO of the following are valid methods to connect an on-premises data center to an Amazon VPC over a private, dedicated network connection? (Choose two.)

Select 2 answers

A.VPC peering

B.AWS Direct Connect

C.AWS Direct Connect with a VPN (IPsec) over the private VIF

D.AWS Site-to-Site VPN over the internet

E.AWS Client VPN

AnswersB, C

AWS Direct Connect provides a dedicated private connection from on-premises to VPC.

Why this answer

AWS Direct Connect provides a dedicated private connection. AWS VPN can also be used over the internet but is not dedicated; however, a VPN over Direct Connect is possible. The question asks for 'private, dedicated network connection', so Direct Connect is the primary method.

VPN over internet is not dedicated. VPN over Direct Connect uses the dedicated connection.

Practice this question →

154

MCQmedium

A company has a VPC with a CIDR of 10.0.0.0/16. They have two Availability Zones, each with a public subnet (10.0.1.0/24 and 10.0.2.0/24) and a private subnet (10.0.3.0/24 and 10.0.4.0/24). They have an internet-facing ALB in the public subnets and EC2 instances in the private subnets. The EC2 instances need to download updates from the internet. They deploy a NAT Gateway in each public subnet and add routes in the private subnet route tables pointing to the respective NAT Gateway in the same AZ. However, the EC2 instances in AZ2 cannot access the internet, while those in AZ1 can. What is the most likely cause?

A.The security group of the EC2 instances in AZ2 is blocking outbound traffic.

B.The NAT Gateway in AZ2 does not have an Elastic IP address assigned.

C.The private subnet in AZ2 is routing traffic to the NAT Gateway in AZ1, which is in a different Availability Zone and incurs cross-AZ charges but should still work.

D.The route table for the private subnet in AZ2 is missing a route to the NAT Gateway.

AnswerB

A NAT Gateway requires an Elastic IP; without it, it cannot route traffic to the internet.

Why this answer

The NAT Gateway in AZ2 does not have an Elastic IP address assigned. A NAT Gateway requires an Elastic IP to enable outbound internet traffic. Without it, the NAT Gateway cannot route traffic to the internet, causing the EC2 instances in AZ2 to fail to download updates.

Option A is incorrect because security group rules are account-level and would affect both AZs equally. Option C is incorrect because the route table in AZ2 is configured to point to the NAT Gateway in the same AZ, not cross-AZ. Option D is incorrect because the route table for the private subnet in AZ2 does have a route to the NAT Gateway, but the NAT Gateway itself is missing the Elastic IP.

Practice this question →

155

MCQmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from an S3 bucket in the same region. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should the company implement?

A.Create a VPC Interface Endpoint for S3 and attach it to the private subnet.

B.Configure an S3 bucket policy to allow access from the VPC and use an Internet Gateway.

C.Create a VPC Gateway Endpoint for S3 and attach it to the private subnet's route table.

D.Create a NAT Gateway in the public subnet and route traffic to the S3 bucket through it.

AnswerC

Gateway Endpoint is free and provides private connectivity to S3.

Why this answer

A VPC Gateway Endpoint for S3 provides private, cost-free connectivity to S3 from within a VPC without traversing the internet. It uses prefix-based routing via the route table, ensuring traffic to S3 stays within the AWS network, minimizing data transfer costs and avoiding internet egress charges.

Exam trap

The trap here is that candidates often confuse Gateway Endpoints with Interface Endpoints, assuming Interface Endpoints are always the better choice for private connectivity, but for S3 and DynamoDB, Gateway Endpoints are the cost-optimized solution that avoids data transfer charges.

How to eliminate wrong answers

Option A is wrong because a VPC Interface Endpoint for S3 is a PrivateLink-based endpoint that incurs hourly charges and per-GB data processing fees, making it more expensive than a Gateway Endpoint for S3, which has no such costs. Option B is wrong because using an Internet Gateway would route traffic over the internet, incurring data transfer costs and violating the requirement to avoid traversing the internet. Option D is wrong because a NAT Gateway also routes traffic over the internet, incurring NAT Gateway hourly charges and data processing fees, plus internet egress costs, which contradicts the goal of minimizing costs and avoiding internet traversal.

Practice this question →

156

MCQmedium

A company has a VPC with multiple subnets. They want to centrally control outbound traffic to the internet and log all traffic. Which AWS service should they use?

A.NAT Gateway

B.Network ACL

C.VPC Flow Logs

D.VPC Traffic Mirroring

AnswerA

Correct. NAT Gateway centralizes outbound internet traffic, and combined with VPC Flow Logs, you can log all traffic. This satisfies both requirements.

Why this answer

NAT Gateway provides centralized outbound internet access for instances in private subnets. While it does not natively log traffic, you can enable VPC Flow Logs on the VPC to capture metadata of all traffic, including that traversing the NAT Gateway. This combination meets both the control and logging requirements.

Other options either fail to control traffic (VPC Traffic Mirroring only copies, VPC Flow Logs only logs) or provide control at a different level (Network ACL is stateless and subnet-level).

Exam trap

Candidates often assume VPC Traffic Mirroring can both control and log, but it only copies traffic; it does not enforce policies. The correct approach is to use a service that actually controls outbound traffic, such as NAT Gateway, and add logging via VPC Flow Logs.

How to eliminate wrong answers

Option A is wrong because a NAT Gateway enables outbound internet traffic for private subnets but does not log or centrally control traffic; it only translates private IPs to a public IP. Option B is wrong because a Network ACL is a stateless firewall that filters traffic at the subnet boundary but does not log or centrally control outbound traffic; it only allows or denies packets based on rules. Option C is wrong because VPC Flow Logs capture metadata (IP addresses, ports, protocols) about traffic flows but do not provide centralized control or full packet-level logging for inspection.

Practice this question →

157

MCQmedium

A company is designing a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to download patches from the internet. The company wants to minimize costs while ensuring high availability. Which solution meets these requirements?

A.Create a NAT gateway in one public subnet and use a second NAT gateway in a different AZ as a backup, but only route traffic to the primary.

B.Create a NAT gateway in one public subnet and configure route tables for private subnets to use it.

C.Launch a NAT instance in one public subnet and configure route tables for private subnets to use it.

D.Create a NAT gateway in a public subnet in each Availability Zone and configure route tables for private subnets to use the NAT gateway in the same AZ.

AnswerD

Highly available and cost-effective with proper AZ-level routing.

Why this answer

Deploying a NAT gateway in each Availability Zone ensures high availability by eliminating a single point of failure, while the private subnets in each AZ use the local NAT gateway for outbound internet access. This design meets the requirement for high availability at minimal cost compared to other resilient architectures, as NAT gateways are fully managed and scale automatically.

Exam trap

The trap here is that candidates often choose a single NAT gateway (Option B) thinking it is sufficient for high availability, but AWS explicitly recommends one NAT gateway per AZ for fault tolerance, and the exam expects you to recognize that a single AZ design is not highly available.

How to eliminate wrong answers

Option A is wrong because using a second NAT gateway as a backup but not routing traffic to it creates a single point of failure; if the primary NAT gateway fails, traffic is dropped, and the backup is unused. Option B is wrong because a single NAT gateway in one AZ is not highly available; if that AZ or the NAT gateway fails, all private instances lose internet access. Option C is wrong because a NAT instance is a single EC2 instance that is not highly available, requires manual failover, and incurs additional management overhead and potential cost for an instance that must be sized for peak traffic.

Practice this question →

158

Multi-Selecthard

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a subnet that hosts a web application. They need to ensure that traffic from the on-premises network to the web application does not traverse the internet. Which TWO components are required? (Select TWO.)

Select 2 answers

A.Internet Gateway attached to the VPC

B.Direct Connect Gateway associated with the Transit Gateway

C.Direct Connect private virtual interface attached to a Direct Connect Gateway

D.Site-to-Site VPN connection to the Transit Gateway

E.CloudFront distribution in front of the web application

AnswersB, C

This allows the Direct Connect connection to be propagated to the Transit Gateway.

Why this answer

A Direct Connect Gateway associated with the Transit Gateway allows traffic from on-premises networks to reach VPCs attached to the Transit Gateway without traversing the internet. This association enables the Transit Gateway to route traffic between Direct Connect virtual interfaces and VPC attachments using private IP addresses, ensuring the path remains over the AWS private network.

Exam trap

The ANS-C01 exam often tests the misconception that a Site-to-Site VPN can provide private connectivity, but the trap here is that VPNs still traverse the public internet (even if encrypted), whereas Direct Connect provides a dedicated private path that avoids internet transit entirely.

Practice this question →

159

MCQeasy

A networking engineer is troubleshooting connectivity issues between two VPCs that are peered using a VPC peering connection. The VPCs are in different AWS accounts. The engineer has verified that the route tables are correct and the security groups allow traffic. However, ICMP ping fails from an instance in VPC A to an instance in VPC B. What is a likely cause?

A.The route tables in both VPCs do not have the route propagation enabled.

B.The VPC CIDR blocks overlap.

C.There is a VPN connection attached to both VPCs that creates a transitive routing issue.

D.The security group in VPC A does not allow inbound ICMP from VPC B.

E.The network ACLs are not configured correctly for return traffic.

AnswerC

VPC peering does not support transitive routing; if there is another connection that could create a transitive route, it may cause unexpected behavior.

Why this answer

A VPN connection attached to both VPCs can introduce transitive routing, which is not supported by VPC peering. VPC peering does not allow transitive routing; traffic must flow directly between the peered VPCs. If both VPCs have a VPN connection to the same on-premises network or another network, the VPN can create a path that interferes with the direct peering path, causing ICMP pings to fail even when route tables and security groups are correctly configured.

Exam trap

AWS often tests the concept that VPC peering does not support transitive routing, and candidates may overlook how a VPN connection can inadvertently create a transitive path that breaks direct peering traffic.

How to eliminate wrong answers

Option A is wrong because route propagation is a feature used with virtual private gateways (VPN or Direct Connect) to automatically propagate routes into route tables; it is not required for VPC peering, which uses static routes. Option B is wrong because overlapping CIDR blocks would cause a route conflict that would prevent the VPC peering connection from being established in the first place, not just cause ICMP ping failures after correct route tables are verified. Option D is wrong because the scenario states that security groups allow traffic, and the question specifies that ICMP ping fails from an instance in VPC A to an instance in VPC B, so the security group in VPC A would need to allow outbound ICMP (or the security group in VPC B would need to allow inbound ICMP), but the issue is not about inbound ICMP to VPC A.

Option E is wrong because network ACLs are stateless and must allow both inbound and outbound traffic for the ICMP echo request and reply; however, the engineer has verified that route tables and security groups are correct, and network ACLs are not mentioned as verified, but the most likely cause among the options is the transitive routing issue, not a misconfigured network ACL.

Practice this question →

160

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise a specific prefix (10.0.0.0/16) to AWS. The VPC CIDR is 10.0.0.0/16. The company wants to ensure that traffic from the VPC to on-premises uses the Direct Connect connection. However, traffic is going over the internet instead. What is the most likely cause?

A.The on-premises BGP ASN is prepended, causing the route to be less preferred.

B.The on-premises prefix is less specific than the VPC CIDR, so the VPC route takes precedence.

C.The VPC CIDR overlaps with the on-premises prefix, and the local route in the VPC route table takes precedence.

D.The BGP route is not being propagated into the VPC route table.

AnswerC

Overlapping CIDRs cause the local route to be used, ignoring Direct Connect.

Why this answer

When a VPC CIDR (10.0.0.0/16) exactly matches a prefix advertised via Direct Connect (10.0.0.0/16), the VPC's local route (which is implicitly created for the VPC CIDR) takes precedence over any propagated BGP route. This is because AWS route tables prioritize the most specific matching route, and when prefixes are identical, the local route is preferred over static or propagated routes. As a result, traffic destined for 10.0.0.0/16 stays within the VPC instead of being sent over the Direct Connect connection.

Exam trap

The ANS-C01 exam often tests the misconception that BGP propagated routes can override the VPC local route when prefixes are identical, but the trap here is that AWS always prioritizes the local route for exact CIDR matches, regardless of BGP attributes or propagation status.

How to eliminate wrong answers

Option A is wrong because ASN prepending makes a BGP route less preferred on the on-premises side, not on the AWS side; AWS does not use AS path length to influence route preference in VPC route tables. Option B is wrong because the on-premises prefix (10.0.0.0/16) is exactly as specific as the VPC CIDR (10.0.0.0/16), not less specific; less specific prefixes would be /17 or larger, which would not override the local route. Option D is wrong because if the BGP route were not propagated, the VPC route table would not have any route for 10.0.0.0/16 via Direct Connect, but the question states traffic is going over the internet, implying a default route or internet gateway route is being used instead of the Direct Connect path.

Practice this question →

161

MCQmedium

A company is running a stateful firewall appliance in an EC2 instance in a VPC. The appliance inspects traffic between subnets. The company needs to ensure that traffic from the web tier subnet to the application tier subnet passes through the firewall, but the firewall itself must not affect other traffic. Which configuration should the company implement?

A.Place the firewall in the same subnet as the web tier and use security groups to redirect traffic.

B.Place the firewall in a separate subnet and use network ACLs to force traffic through it.

C.Use a Gateway Load Balancer to deploy the firewall appliance in a separate subnet, and configure route tables to send inter-subnet traffic to the Gateway Load Balancer endpoint.

D.Use a transit gateway with appliance mode and attach all subnets to it, then configure routing to send traffic through the firewall.

AnswerC

GWLB transparently intercepts traffic for inspection.

Why this answer

A Gateway Load Balancer (GWLB) allows you to deploy a fleet of third-party firewall appliances in a separate subnet and use a Gateway Load Balancer endpoint (GWLBe) to transparently intercept and steer inter-subnet traffic through the firewall. By configuring the route tables of the web and application subnets to send traffic to the GWLBe, the firewall inspects only the desired traffic without affecting other VPC traffic, as the GWLB operates at Layer 3 (Geneve encapsulation) and does not alter the source/destination IP addresses.

Exam trap

The ANS-C01 exam often tests the misconception that network ACLs or security groups can redirect traffic to a firewall appliance, but these are filtering mechanisms, not routing or forwarding mechanisms; the trap here is confusing stateless/stateful filtering with traffic steering, which requires route table manipulation or a Gateway Load Balancer endpoint.

How to eliminate wrong answers

Option A is wrong because placing the firewall in the same subnet as the web tier and using security groups to redirect traffic is not possible; security groups are stateful filters that cannot redirect traffic, and they evaluate traffic at the instance level, not between subnets. Option B is wrong because network ACLs are stateless packet filters that can only allow or deny traffic based on rules; they cannot force traffic through a specific appliance or redirect packets to a different destination. Option D is wrong because a transit gateway with appliance mode is designed for centralized inspection of traffic between VPCs or on-premises networks, not for intra-VPC subnet-to-subnet traffic; using it for inter-subnet traffic would add unnecessary complexity and cost, and it would affect all traffic passing through the transit gateway, not just the desired flows.

Practice this question →

162

MCQmedium

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in each region. They need to route traffic to the closest healthy endpoint. Which AWS service should be used for global load balancing?

A.Use a single Application Load Balancer in one region with cross-region VPC peering.

B.Use AWS Global Accelerator with an endpoint group in each region.

C.Use Route 53 latency-based routing with health checks.

D.Use a Network Load Balancer in each region and Route 53 weighted routing.

AnswerB

Global Accelerator provides anycast IP and routes to the closest healthy endpoint.

Why this answer

AWS Global Accelerator uses the AWS global network to route traffic to the closest healthy endpoint via Anycast IP addresses and endpoint groups in each region. It provides static IP addresses and intelligent traffic distribution based on latency, health, and geography, making it ideal for multi-region ALB architectures requiring global load balancing.

Exam trap

The trap here is that candidates often confuse Route 53 latency-based routing with true global load balancing, not realizing that DNS-based routing is affected by client caching and does not provide real-time traffic steering or static IP addresses, which Global Accelerator uniquely offers.

How to eliminate wrong answers

Option A is wrong because a single Application Load Balancer cannot span multiple regions; cross-region VPC peering does not provide global load balancing or anycast routing, and it introduces single-region failure risk. Option C is wrong because Route 53 latency-based routing operates at the DNS level, which can be affected by DNS caching and does not provide real-time traffic steering or static IP addresses; it also lacks the ability to route based on endpoint health at the network level. Option D is wrong because Network Load Balancers are regional and Route 53 weighted routing distributes traffic based on static weights, not proximity or real-time latency, and it does not provide the global anycast optimization that Global Accelerator offers.

Practice this question →

163

MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs. The network team notices that traffic between two VPCs is taking a suboptimal path through a third VPC. What is the most likely cause?

A.Security groups are blocking the direct path, forcing traffic through a third VPC.

B.BGP is not configured between the VPCs, so traffic defaults through a transit VPC.

C.ECMP routing is enabled, causing traffic to be load-balanced across multiple paths.

D.Incorrect route table associations and propagations in the Transit Gateway.

AnswerD

Route tables determine which attachments can reach each other.

Why this answer

Incorrect route table associations and propagations in the Transit Gateway cause traffic between two VPCs to take a suboptimal path through a third VPC. The Transit Gateway uses route tables to determine the next hop for traffic; if the route table for the source VPC does not have a direct route to the destination VPC but instead has a route pointing to the third VPC (e.g., via a VPN attachment or a transit VPC attachment), traffic will be forwarded through that third VPC. This is a common misconfiguration when route propagation is not properly set up or when static routes are incorrectly prioritized.

Exam trap

The trap here is that candidates often assume traffic between VPCs in a Transit Gateway always takes the most direct path, but they overlook that route table associations and propagations control the path, and a misconfigured route table can force traffic through an intermediate VPC even when a direct attachment exists.

How to eliminate wrong answers

Option A is wrong because security groups are stateful firewalls that filter traffic at the instance or ENI level, not at the Transit Gateway or VPC routing level, and they cannot force traffic to take a different network path through a third VPC. Option B is wrong because BGP is not required for VPC-to-VPC routing through a Transit Gateway; Transit Gateway uses its own route tables and attachments, and traffic does not 'default' through a transit VPC unless routes are explicitly configured to do so. Option C is wrong because ECMP (Equal-Cost Multi-Path) routing is a load-balancing mechanism that distributes traffic across multiple equal-cost paths, but it does not cause traffic to take a suboptimal path through a third VPC; it would only apply if multiple direct paths existed.

Practice this question →

164

MCQeasy

A company is deploying a web application across multiple Availability Zones in a VPC. The application tier consists of EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and the EC2 instances be encrypted. Which solution meets this requirement?

A.Use an internal ALB with a TCP listener and a security group that allows only HTTPS.

B.Use an HTTP listener on the ALB and enable encryption on the security group.

C.Use an HTTPS listener on the ALB with a target group that uses HTTPS.

D.Use a TCP listener on the ALB with a target group that uses TCP.

AnswerC

HTTPS provides end-to-end encryption.

Why this answer

To encrypt traffic between the Application Load Balancer (ALB) and the EC2 instances, the ALB must use an HTTPS listener and the target group must be configured with the HTTPS protocol. This ensures that the ALB terminates the client’s HTTPS connection and then re-encrypts traffic to the backend instances using TLS, meeting the security team’s requirement for end-to-end encryption.

Exam trap

The trap here is that candidates often assume a TCP listener can provide encryption by using a security group, but security groups do not encrypt traffic—they only filter based on IP/port, and TCP listeners do not support TLS termination or re-encryption.

How to eliminate wrong answers

Option A is wrong because an internal ALB with a TCP listener does not provide encryption; TCP listeners pass traffic without TLS termination, and security groups do not encrypt traffic—they only filter it. Option B is wrong because an HTTP listener does not encrypt traffic between the ALB and clients, and enabling encryption on a security group is not a valid concept; security groups are stateful firewalls, not encryption mechanisms. Option D is wrong because a TCP listener with a TCP target group does not support TLS encryption; it forwards raw TCP traffic without any encryption between the ALB and the instances.

Practice this question →

165

MCQmedium

A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Direct Connect private VIF. The VPC has a virtual private gateway attached. The on-premises router can ping the private IP of an EC2 instance in the VPC, but application traffic (TCP port 443) fails. What is the most likely cause?

A.The network ACL in the VPC is blocking outbound traffic.

B.The security group for the EC2 instance does not allow inbound HTTPS traffic.

C.The BGP session is in the 'Idle' state.

D.The route table associated with the virtual private gateway does not have a route to the on-premises network.

AnswerB

Security groups are stateful, so outbound return traffic is allowed automatically. The inbound rule for HTTPS must be present.

Why this answer

Since the on-premises router can ping the EC2 instance's private IP, Layer 3 connectivity is working, which rules out routing and BGP issues. The failure of TCP port 443 specifically points to a firewall or access control blocking the application traffic. A security group acts as a virtual firewall at the instance level, and by default it denies all inbound traffic unless explicitly allowed.

Therefore, the most likely cause is that the security group for the EC2 instance does not have an inbound rule permitting HTTPS (TCP 443) traffic.

Exam trap

The trap here is that candidates assume ping success implies full application-layer connectivity, but security groups can selectively block specific protocols or ports while allowing ICMP, leading to a false sense of network health.

How to eliminate wrong answers

Option A is wrong because a network ACL is stateless and operates at the subnet level; if outbound traffic were blocked, the ping reply (ICMP) would also fail, but ping succeeds, so this is not the issue. Option C is wrong because if the BGP session were in the 'Idle' state, the virtual private gateway would not have learned the on-premises routes, making Layer 3 connectivity impossible and ping would fail. Option D is wrong because if the route table associated with the virtual private gateway lacked a route to the on-premises network, return traffic from the VPC would not be forwarded, and ping replies would not reach the on-premises router, yet ping succeeds.

Practice this question →

166

Multi-Selecthard

Which TWO scenarios are best suited for using AWS Transit Gateway over VPC peering? (Select TWO.)

Select 2 answers

A.Connecting VPCs in different AWS accounts

B.Connecting a single VPC to an on-premises network

C.Connecting hundreds of VPCs across multiple accounts

D.Connecting VPCs to on-premises via Direct Connect

E.Connecting two VPCs in the same account and region

AnswersC, D

Transit Gateway simplifies hub-and-spoke topology.

Why this answer

AWS Transit Gateway is designed to act as a central hub for connecting multiple VPCs and on-premises networks, simplifying management and reducing the number of connections. Option C is correct because Transit Gateway can scale to connect hundreds of VPCs across multiple accounts using a hub-and-spoke model, whereas VPC peering would require a full mesh of point-to-point connections, which becomes unmanageable and hits the hard limit of 125 peering connections per VPC. Option D is correct because Transit Gateway natively integrates with AWS Direct Connect via a Direct Connect Gateway, allowing a single Transit Gateway to route traffic from multiple VPCs to on-premises without needing individual VPN tunnels or complex routing configurations.

Exam trap

The trap here is that candidates assume VPC peering is always simpler for cross-account or on-premises connections, but the exam tests the scalability and management overhead differences, especially when the number of VPCs exceeds a handful or when transitive routing is required.

Practice this question →

167

MCQhard

A company is deploying a global application with users in North America and Europe. They have set up an Application Load Balancer (ALB) in us-east-1 and another in eu-west-1. They want to route users to the nearest ALB using AWS Global Accelerator. What is the correct configuration to achieve this?

A.Use Amazon CloudFront with origins pointing to each ALB

B.Place each ALB behind a Network Load Balancer and use Global Accelerator

C.Create a Global Accelerator accelerator with endpoint groups in each region, each pointing to the respective ALB

D.Create a Route 53 latency record set with aliases to each ALB

AnswerC

Correct; Global Accelerator uses Anycast to route to the nearest healthy ALB.

Why this answer

AWS Global Accelerator uses Anycast IPs to direct traffic to the nearest healthy endpoint group. By creating an accelerator with endpoint groups in us-east-1 and eu-west-1, each pointing to its respective ALB, Global Accelerator automatically routes users to the closest region based on latency and network conditions. This provides both performance optimization and high availability without additional intermediate load balancers.

Exam trap

The trap here is that candidates often confuse Global Accelerator with CloudFront or Route 53 latency routing, not realizing that Global Accelerator provides static IP addresses and sub-second failover by using Anycast at the network layer, whereas CloudFront is a CDN and Route 53 is DNS-based with inherent caching delays.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront is a content delivery network (CDN) optimized for caching static and dynamic content at edge locations, not for routing TCP/UDP traffic to the nearest ALB; it would add unnecessary latency and complexity for non-HTTP traffic or real-time applications. Option B is wrong because placing each ALB behind a Network Load Balancer (NLB) is unnecessary and adds an extra hop; Global Accelerator can directly use ALBs as endpoints in endpoint groups without requiring an NLB intermediary. Option D is wrong because Route 53 latency record sets rely on DNS-based routing, which introduces caching and TTL delays, cannot provide fast failover or static IP addresses, and does not offer the same performance optimization as Global Accelerator's Anycast network.

Practice this question →

168

Multi-Selectmedium

A company is designing a VPC with multiple subnets for a three-tier application. They need to ensure that the database tier (private subnet) can be accessed only by the application tier (private subnet) and that no other resources in the VPC can access the database. Which TWO security mechanisms should be used together to achieve this? (Choose TWO.)

Select 2 answers

A.Route tables

B.VPC Flow Logs

C.Security groups

D.Network ACLs

E.IAM policies attached to the database instances

AnswersC, D

Correct; security groups act as virtual firewalls at the instance level.

Why this answer

Options C (Security groups) and D (Network ACLs) are correct. Security groups act as stateful firewalls at the instance level, allowing traffic from the application tier to the database instances. Network ACLs provide stateless filtering at the subnet level, restricting inbound traffic to the database subnet exclusively from the application subnet.

Together, they enforce the required access control. Option A is incorrect because route tables control network routing, not traffic filtering. Option B (VPC Flow Logs) is for monitoring network traffic, not access control.

Option E (IAM policies) manage permissions for AWS API calls, not network traffic.

Practice this question →

169

MCQeasy

A network engineer is designing a VPC with public and private subnets. The private subnets must have outbound internet access but not be directly reachable from the internet. Which AWS service should be used?

A.NAT Gateway

B.Elastic IP Address (EIP)

C.Internet Gateway (IGW)

D.Virtual Private Gateway (VGW)

AnswerA

NAT Gateway provides outbound internet without inbound.

Why this answer

A NAT Gateway is the correct choice because it enables instances in private subnets to initiate outbound internet traffic (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT Gateway's Elastic IP address, providing one-way internet access without direct reachability.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with an Internet Gateway, mistakenly thinking an IGW can provide outbound-only access, when in fact an IGW allows bidirectional traffic and would expose private subnets to the internet.

How to eliminate wrong answers

Option B (Elastic IP Address) is wrong because an EIP is a static public IPv4 address that, when attached to an instance, makes that instance directly reachable from the internet, which violates the requirement that private subnets not be directly reachable. Option C (Internet Gateway) is wrong because an IGW allows bidirectional communication between a VPC and the internet; attaching an IGW to a private subnet would make instances in that subnet directly reachable from the internet, defeating the purpose of a private subnet. Option D (Virtual Private Gateway) is wrong because a VGW is used to establish VPN or Direct Connect connections to on-premises networks, not to provide outbound internet access from a VPC.

Practice this question →

170

MCQhard

A company is running a two-tier application with a web tier and a database tier. The web tier must be accessible from the internet, but the database tier should only be accessible from the web tier. Which architecture should they use?

A.Web tier in public subnet, database tier in private subnet with a security group allowing only web tier.

B.Both tiers in public subnets with security groups restricting database access.

C.Both tiers in private subnets with a NAT Gateway for internet access.

D.Web tier in private subnet, database tier in public subnet with a security group.

AnswerA

This architecture provides internet access to the web tier and isolates the database.

Why this answer

The correct architecture places the web tier in a public subnet with an internet gateway for inbound traffic, and the database tier in a private subnet with a security group that only allows inbound traffic from the web tier's security group. This ensures the database is not directly reachable from the internet, adhering to the principle of least privilege and defense in depth. The security group acts as a stateful virtual firewall, allowing you to reference the web tier's security group as the source, which automatically adapts to any changes in the web tier's IP addresses.

Exam trap

The ANS-C01 exam often tests the misconception that security groups alone can secure a database in a public subnet, but the trap here is that a public subnet inherently provides a route to the internet via an internet gateway, making the database reachable from the internet even with restrictive security groups.

How to eliminate wrong answers

Option B is wrong because placing both tiers in public subnets exposes the database tier to the internet, even with security group restrictions; a misconfiguration or a zero-day vulnerability could still allow direct internet access to the database. Option C is wrong because placing both tiers in private subnets would require a NAT Gateway for the web tier to receive internet traffic, but a NAT Gateway only supports outbound-initiated traffic, not inbound connections from the internet, making the web tier inaccessible. Option D is wrong because placing the web tier in a private subnet and the database tier in a public subnet reverses the security model, exposing the database directly to the internet while the web tier cannot be reached from the internet without additional components like a load balancer or VPN.

Practice this question →

171

MCQhard

A company is deploying a multi-region application and needs to route users to the nearest healthy endpoint. They are using Amazon Route 53 with latency-based routing and health checks. Users in Asia are sometimes routed to the US region even when the Asia endpoint is healthy. What is the most likely cause?

A.The Asia region endpoint's Route 53 geolocation routing policy is misconfigured

B.The health check for the Asia region endpoint is failing or misconfigured

C.The TTL value for the DNS records is set too high

D.The DNS resolver used by users in Asia does not support latency-based routing

AnswerB

If the health check fails, Route 53 excludes the unhealthy endpoint and routes to the next best latency.

Why this answer

Latency-based routing selects the endpoint with the lowest latency for the user. If users in Asia are routed to the US even when the Asia endpoint is healthy, the most likely cause is that the health check for the Asia endpoint is failing or misconfigured. When a health check fails, Route 53 considers the endpoint unhealthy and excludes it from latency-based routing, causing traffic to be sent to the next-best region (e.g., US).

Exam trap

The trap here is that candidates may assume latency-based routing always routes to the geographically closest region, but it actually routes based on measured network latency, and a failing health check overrides latency calculations by excluding the endpoint entirely.

How to eliminate wrong answers

Option A is wrong because geolocation routing is a separate policy that routes based on user location, not latency; the question explicitly states latency-based routing is used, so a geolocation misconfiguration would not affect latency-based routing behavior. Option C is wrong because a high TTL value would cause DNS caching and delayed propagation of record changes, but it would not cause consistent routing to a different region when the local endpoint is healthy; the issue described is a routing decision, not a caching delay. Option D is wrong because DNS resolvers do not need to 'support' latency-based routing; Route 53 performs the latency evaluation on the server side based on the resolver's IP address, and all standard DNS resolvers work with this mechanism.

Practice this question →

172

Multi-Selectmedium

Which THREE of the following are valid methods to connect a VPC to an on-premises network?

Select 3 answers

A.AWS Direct Connect

B.VPC Peering

C.Site-to-Site VPN

D.AWS Transit Gateway

E.VPC Endpoint

AnswersA, C, D

Direct Connect provides a dedicated private connection.

Why this answer

AWS Direct Connect is a valid method to connect a VPC to an on-premises network because it provides a dedicated, private, high-bandwidth physical connection from your on-premises data center to AWS, bypassing the public internet. This connection uses industry-standard 802.1Q VLANs to create virtual interfaces (VIFs) that directly access VPCs or AWS services, offering consistent network performance and reduced latency compared to internet-based connections.

Exam trap

The trap here is that candidates often confuse VPC Peering (which only connects VPCs) or VPC Endpoints (which only connect to AWS services) as valid methods for on-premises connectivity, when in fact only Direct Connect, Site-to-Site VPN, and Transit Gateway (which can aggregate VPN and Direct Connect connections) are correct.

Practice this question →

173

MCQeasy

A company is deploying a public-facing web application on EC2 instances behind an Application Load Balancer. The ALB is configured to terminate HTTPS using a certificate from AWS Certificate Manager. What additional step is required to ensure the ALB can validate the certificate?

A.Attach the certificate to an Amazon CloudFront distribution.

B.Ensure the certificate is in the same AWS region as the ALB.

C.Create a DNS record to validate domain ownership.

D.Import the certificate into AWS Certificate Manager Private Certificate Authority.

AnswerB

ACM certificates are region-specific.

Why this answer

For an Application Load Balancer to terminate HTTPS using a certificate from AWS Certificate Manager (ACM), the certificate must be in the same AWS region as the ALB. ACM certificates are region-specific resources; the ALB can only reference certificates that are stored in the same region where the ALB is deployed. This is a fundamental constraint of ACM integration with regional services like ALB.

Exam trap

The ANS-C01 exam often tests the misconception that ACM certificates are globally available or can be used across regions, when in fact they are region-specific and must match the ALB's region.

How to eliminate wrong answers

Option A is wrong because attaching the certificate to a CloudFront distribution is an alternative way to serve HTTPS content, but it does not help the ALB validate or use the certificate; CloudFront requires its own certificate (either from ACM in us-east-1 or imported) and is a separate service. Option C is wrong because DNS record validation is a method to prove domain ownership when requesting a certificate from ACM, not a step required after the certificate is issued and being used by the ALB; the certificate validation is already complete before it can be deployed. Option D is wrong because importing the certificate into ACM Private Certificate Authority (PCA) is for creating private certificates for internal use, not for public-facing web applications; the question specifies a public-facing application using a certificate from ACM (public CA), and PCA is irrelevant here.

Practice this question →

174

MCQhard

A company has multiple VPCs connected via AWS Transit Gateway. Each VPC has its own route table in the transit gateway. The company wants to restrict traffic between certain VPCs. For example, VPC A should be able to send traffic to VPC B but not to VPC C. VPC B should be able to send traffic to VPC C. Which configuration should the company use?

A.Use network ACLs on the transit gateway attachments to filter traffic.

B.Use security groups on the VPC attachments to allow or deny traffic.

C.Create separate transit gateway route tables for each VPC and add only the desired routes for other VPCs.

D.Create a single transit gateway route table and associate all VPC attachments with it.

AnswerC

Enables selective communication.

Why this answer

AWS Transit Gateway supports multiple route tables, and by creating a separate route table for each VPC attachment, you can control which VPCs can communicate by selectively adding routes to the desired destination VPC CIDRs. This allows VPC A to have a route only to VPC B, while VPC B's route table includes routes to both VPC A and VPC C, achieving the required traffic isolation without relying on stateful or stateless filtering at the attachment level.

Exam trap

The trap here is that candidates often confuse Transit Gateway route tables with VPC route tables or assume that security groups or network ACLs can be applied to Transit Gateway attachments, when in fact route table isolation is the only native mechanism for controlling inter-VPC traffic at the Transit Gateway level.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless packet filters that operate at the subnet level within a VPC, not on Transit Gateway attachments; Transit Gateway does not support network ACLs on attachments. Option B is wrong because security groups are stateful firewalls that apply to ENIs within a VPC, not to Transit Gateway VPC attachments; they cannot be directly associated with a Transit Gateway attachment to filter inter-VPC traffic. Option D is wrong because a single transit gateway route table shared by all VPCs would allow any VPC to route traffic to any other VPC that has a route in that table, failing to restrict traffic between VPC A and VPC C.

Practice this question →

175

Multi-Selectmedium

Which TWO of the following are benefits of using an AWS Transit Gateway over VPC peering for connecting multiple VPCs? (Select TWO.)

Select 2 answers

A.Lower data transfer costs between VPCs.

B.Built-in internet gateway for all attached VPCs.

C.Automatic encryption of traffic between VPCs.

D.Transitive routing between all attached VPCs.

E.Centralised management of network policies and routing.

AnswersD, E

Hub-and-spoke model allows any-to-any connectivity.

Why this answer

AWS Transit Gateway supports transitive routing, meaning that any VPC attached to the transit gateway can communicate with any other attached VPC through a single central hub. This eliminates the need to establish a full mesh of VPC peering connections, which would require n*(n-1)/2 individual peering links and manual route table entries for each pair. In contrast, VPC peering does not support transitive routing—if VPC A is peered with VPC B and VPC B is peered with VPC C, VPC A cannot route to VPC C through VPC B.

Exam trap

The ANS-C01 exam often tests the misconception that Transit Gateway provides lower costs or built-in encryption, when in fact the primary benefits are transitive routing and centralized management, not cost savings or automatic security features.

Practice this question →

176

MCQeasy

A network engineer is setting up a site-to-site VPN connection between an on-premises network and an AWS VPC. The engineer configures the customer gateway device with the correct parameters. However, the VPN tunnel status remains 'DOWN'. What is the most likely cause?

A.The virtual private gateway is not attached to the customer gateway.

B.The VPN connection is not associated with a subnet.

C.The pre-shared key on the customer gateway device does not match the pre-shared key configured in the VPN connection.

D.The security group associated with the VPN endpoint is blocking the traffic.

AnswerC

Mismatched PSK prevents IKE negotiation.

Why this answer

The most likely cause is a mismatch in the pre-shared key (PSK) between the customer gateway device and the VPN connection configuration in AWS. IPsec tunnel establishment requires both ends to authenticate using identical PSK values; if they differ, the Internet Key Exchange (IKE) phase 1 negotiation fails, leaving the tunnel status 'DOWN'. This is a common configuration error that directly prevents the VPN from coming up.

Exam trap

The trap here is that candidates confuse security groups (which apply to VPC resources) with VPN tunnel authentication, leading them to incorrectly select Option D, when in fact security groups have no bearing on IPsec tunnel state.

How to eliminate wrong answers

Option A is wrong because the virtual private gateway (VGW) is attached to the VPC, not to the customer gateway (CGW); the CGW is a separate resource that represents the on-premises router, and the VPN connection links the VGW and CGW. Option B is wrong because a VPN connection is not associated with a subnet; it is a logical connection between the VGW and CGW, and traffic is routed via the route table, not by subnet association. Option D is wrong because security groups apply to ENIs within a VPC, not to VPN endpoints; the VPN tunnel operates at Layer 3 (IPsec) and is not subject to security group rules—network ACLs or firewall rules on the CGW could block traffic, but security groups are irrelevant here.

Practice this question →

177

MCQmedium

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The VPC uses a virtual private gateway (VGW). The on-premises network advertises a route to a specific subnet (10.0.0.0/24) via BGP. However, traffic from the VPC to that subnet is failing. What should the network engineer check first?

A.Verify that the customer gateway device is advertising the subnet route.

B.Verify that the virtual interface is in the 'available' state and BGP session is established.

C.Verify that the VGW is attached to the VPC.

D.Verify that route propagation is enabled on the VPC's route tables associated with the subnets.

AnswerD

Without route propagation, the BGP routes from Direct Connect are not added to the route tables.

Why this answer

The most common cause of traffic failure from a VPC to an on-premises subnet over Direct Connect is that the VPC route tables do not have a route for the on-premises subnet. Even if the VGW is attached and BGP is established, the VPC subnets must have route propagation enabled on their route tables to automatically learn the routes advertised by the on-premises network via BGP. Without this, the VPC has no path to send traffic to the 10.0.0.0/24 subnet.

Exam trap

The trap here is that candidates assume a working BGP session and VIF automatically make the route available in the VPC, overlooking the requirement for route propagation to be explicitly enabled on the VPC's subnet route tables.

How to eliminate wrong answers

Option A is wrong because the question states the on-premises network is already advertising the subnet route via BGP, so verifying the advertisement again is not the first step. Option B is wrong because while a healthy VIF and BGP session are necessary, they are not the first check when the issue is specifically that traffic from the VPC is failing; the VIF state and BGP session could be fine, but the VPC still lacks a route. Option C is wrong because the VGW must be attached for the Direct Connect connection to work at all, and the question implies the VPC is using a VGW, so this is likely already in place; checking attachment is a lower-priority step.

Practice this question →

178

MCQhard

A company is migrating a legacy application to AWS. The application requires multicast communication between instances. The company needs to implement a multicast solution within a VPC. Which AWS service or feature should be used to support multicast?

A.Create a Transit Gateway multicast domain

B.Configure multicast in the VPC's route tables

C.Use AWS Global Accelerator for multicast distribution

D.Set up VPC peering to enable multicast between subnets

AnswerA

Transit Gateway supports multicast groups and can distribute multicast traffic.

Why this answer

AWS Transit Gateway supports multicast through the creation of a Transit Gateway multicast domain. This feature allows you to send multicast traffic from a source to multiple receivers within a VPC, which is required for legacy applications that rely on multicast communication. Transit Gateway multicast domains work with IGMP (Internet Group Management Protocol) to manage group memberships and route multicast traffic efficiently.

Exam trap

The ANS-C01 exam often tests the misconception that VPC route tables or VPC peering can handle multicast, but AWS explicitly does not support multicast natively in VPCs, requiring Transit Gateway multicast domains as the only scalable solution.

How to eliminate wrong answers

Option B is wrong because VPC route tables do not support multicast forwarding; they only handle unicast traffic and do not have the capability to replicate packets to multiple destinations. Option C is wrong because AWS Global Accelerator is designed for unicast traffic optimization using Anycast IPs and does not support multicast distribution or group communication. Option D is wrong because VPC peering does not support multicast traffic; it only allows unicast communication between VPCs and does not forward multicast or broadcast packets.

Practice this question →

179

MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has a NAT gateway in the public subnet. The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT gateway. However, the EC2 instance cannot reach the internet. Which additional configuration is needed?

A.Assign a public IP address to the EC2 instance.

B.Attach a security group to the NAT gateway allowing outbound traffic.

C.Add a route to the NAT gateway in the private subnet's route table for destination 0.0.0.0/0.

D.Ensure the public subnet's route table has a route 0.0.0.0/0 pointing to an internet gateway.

AnswerD

The NAT gateway needs internet access via the internet gateway.

Why this answer

The NAT gateway resides in the public subnet, but it still needs a route to the internet. The public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway (IGW) so that traffic from the NAT gateway can be forwarded to the internet. Without this route, the NAT gateway cannot send traffic beyond the VPC, even though the private subnet's route table correctly points to the NAT gateway.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT gateway automatically has internet access just because it is in a public subnet, but the public subnet itself must have a route to an internet gateway for the NAT gateway to function.

How to eliminate wrong answers

Option A is wrong because assigning a public IP to the EC2 instance in a private subnet does not enable internet access; the instance would still need a route through an internet gateway, and private subnets typically do not have direct IGW routes. Option B is wrong because security groups for NAT gateways are not supported; NAT gateways use network ACLs and security groups are not attached to them. Option C is wrong because the private subnet's route table already has a 0.0.0.0/0 route pointing to the NAT gateway, as stated in the question; adding it again would be redundant and does not solve the missing IGW route in the public subnet.

Practice this question →

180

MCQeasy

A company is deploying a new VPC with public and private subnets. The company wants to ensure that EC2 instances in the private subnet can access the internet for software updates. The instances do not need to be accessible from the internet. The network engineer has created a NAT gateway in the public subnet and added a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. However, instances in the private subnet cannot reach the internet. The NAT gateway is in the 'available' state. What is the MOST likely cause?

A.The NAT gateway is not in a public subnet.

B.The NAT gateway does not have an Elastic IP address associated.

C.The private subnet's route table does not have a default route to the NAT gateway.

D.The security group of the EC2 instances blocks outbound traffic.

AnswerB

NAT gateway requires an EIP for internet access.

Why this answer

An Elastic IP must be associated with the NAT gateway for it to work. Option A is incorrect because the NAT gateway is already in a public subnet. Option C is incorrect because the route is present.

Option D is incorrect because security groups do not block outbound traffic to internet by default.

Practice this question →

181

MCQeasy

A company needs to establish a dedicated, private, high-bandwidth connection between its on-premises data center and AWS. Which AWS service should be used?

A.AWS Direct Connect

B.AWS Transit Gateway

C.AWS Site-to-Site VPN

D.VPC peering

AnswerA

Dedicated private connection.

Why this answer

AWS Direct Connect is the correct service because it provides a dedicated, private, high-bandwidth network connection from an on-premises data center to AWS, bypassing the public internet. This is achieved through a physical cross-connect at an AWS Direct Connect location, delivering consistent latency and higher throughput compared to internet-based connections.

Exam trap

The ANS-C01 exam often tests the misconception that AWS Site-to-Site VPN provides a private, dedicated connection, but it actually runs over the public internet and cannot match the bandwidth or consistency of Direct Connect.

How to eliminate wrong answers

Option B (AWS Transit Gateway) is wrong because it is a network transit hub that interconnects VPCs and on-premises networks via VPN or Direct Connect, but it does not itself provide a dedicated physical connection; it relies on another connectivity method. Option C (AWS Site-to-Site VPN) is wrong because it uses the public internet over IPsec tunnels, which cannot guarantee dedicated, private, high-bandwidth performance due to variable internet conditions and lack of physical isolation. Option D (VPC peering) is wrong because it connects only VPCs within AWS and cannot extend to an on-premises data center; it is a logical connection using AWS internal infrastructure, not a dedicated physical link.

Practice this question →

182

MCQeasy

A company wants to securely connect two VPCs in different AWS regions using AWS infrastructure. Which service should be used?

A.AWS Direct Connect

B.Internet Gateway

C.VPC peering

D.AWS Transit Gateway

AnswerC

VPC peering supports inter-region connections.

Why this answer

VPC peering is the correct service because it allows direct, private connectivity between two VPCs in different AWS regions using AWS's internal network, without traversing the public internet. It uses the existing AWS infrastructure to route traffic between the VPCs via private IP addresses, and it supports inter-region peering as of 2017, making it the simplest and most cost-effective solution for this specific requirement.

Exam trap

The trap here is that candidates often choose AWS Transit Gateway because they think it is required for inter-region connectivity, but they overlook that VPC peering directly supports cross-region connections and is the simpler, more cost-effective option for a two-VPC scenario.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated physical connection from an on-premises data center to AWS, not a service for connecting two VPCs across regions. Option B is wrong because an Internet Gateway provides internet access to a VPC and does not create private connectivity between VPCs; traffic would flow over the public internet, violating the security requirement. Option D is wrong because AWS Transit Gateway is designed for hub-and-spoke connectivity among many VPCs and on-premises networks, but it does not natively support inter-region peering without additional components like a Transit Gateway peering attachment, making it overly complex and not the direct service for a simple two-VPC inter-region connection.

Practice this question →

183

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). They launch a NAT Gateway in the public subnet and add a route in the private subnet route table: destination 0.0.0.0/0, target nat-gateway-id. An EC2 instance in the private subnet can ping an external server, but cannot connect to it via SSH. The security group allows outbound SSH (port 22), and the NACL allows outbound ephemeral ports. What is the likely cause?

A.The NACL on the private subnet is blocking outbound ephemeral ports.

B.The route table in the private subnet does not have a route to the NAT Gateway.

C.The external server's firewall is blocking traffic from the NAT Gateway's Elastic IP address.

D.The NAT Gateway is not configured to allow SSH traffic.

AnswerC

The external server must allow the NAT Gateway's public IP on port 22.

Why this answer

The NAT Gateway translates the private instance's source IP to its own Elastic IP address for outbound traffic. SSH connections require bidirectional communication: the external server must send SYN-ACK packets back to the source IP. If the external server's firewall blocks traffic from the NAT Gateway's Elastic IP, the TCP handshake fails, preventing SSH while ICMP (ping) may still work because ICMP echo requests and replies are stateless and often allowed by default.

Exam trap

The trap here is that candidates assume SSH failure must be due to a missing route or security group misconfiguration, but the real issue is that the external server's firewall is blocking return traffic from the NAT Gateway's Elastic IP, which is a common real-world scenario when the external server has IP-based allowlists.

How to eliminate wrong answers

Option A is wrong because the question explicitly states the NACL allows outbound ephemeral ports, so it is not blocking outbound traffic. Option B is wrong because the question states a route to the NAT Gateway (0.0.0.0/0 -> nat-gateway-id) is already added to the private subnet route table. Option D is wrong because a NAT Gateway operates at Layer 3/4 and does not inspect or filter traffic by protocol or port; it simply forwards packets based on stateful translation, so it does not have a concept of 'allowing SSH'.

Practice this question →

184

MCQeasy

A company is setting up a VPC with both public and private subnets. The private subnets need outbound internet access for software updates. Which component is required to enable this?

A.A NAT gateway in a public subnet.

B.A VPN connection to an on-premises network that has internet access.

C.A VPC peering connection to a VPC that has internet access.

D.An internet gateway attached to the VPC with a route in the private subnet's route table pointing to the internet gateway.

AnswerA

NAT gateway enables outbound internet for private subnets.

Why this answer

A NAT gateway in a public subnet is required to enable outbound internet access for private subnets. The NAT gateway resides in a public subnet with an Internet Gateway (IGW) route, and private subnet route tables direct default traffic (0.0.0.0/0) to the NAT gateway's elastic network interface. This allows instances in private subnets to initiate outbound connections (e.g., for software updates) while preventing unsolicited inbound traffic from the internet.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with an Internet Gateway, thinking a direct IGW route in the private subnet is acceptable, or they mistakenly believe VPC peering or VPN can provide transitive internet access without additional configuration.

How to eliminate wrong answers

Option B is wrong because a VPN connection to an on-premises network that has internet access does not provide direct outbound internet access from the VPC; it only routes traffic to the on-premises network, which would require additional NAT or proxy configuration and introduces latency and dependency on the on-premises internet link. Option C is wrong because a VPC peering connection does not enable transitive internet access; even if the peered VPC has an IGW, the peering connection does not allow traffic from one VPC to use the other VPC's IGW (no transitive routing). Option D is wrong because an Internet Gateway attached to the VPC with a route in the private subnet's route table pointing to the IGW would directly expose private instances to the internet, violating the security model of a private subnet; private subnets must not have a direct IGW route.

Practice this question →

185

Multi-Selectmedium

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The network team wants to isolate traffic between VPCs while allowing all VPCs to reach the on-premises network. Which TWO configurations should be implemented?

Select 2 answers

A.Attach the Direct Connect virtual interface to a VPN attachment on the Transit Gateway

B.Use a Direct Connect gateway to propagate routes to all VPCs

C.Create separate Transit Gateway route tables for each VPC and associate them with the respective VPC attachments

D.Use a single Transit Gateway route table for all attachments

E.Create VPC peering connections between each VPC

AnswersB, C

Using a Direct Connect gateway to propagate routes to all VPCs is not a valid configuration for Transit Gateway. The Direct Connect gateway associates with the Transit Gateway, not directly with VPCs.

Why this answer

Creating separate Transit Gateway route tables for each VPC and associating them with the respective VPC attachments enforces traffic isolation between VPCs: each VPC route table only contains routes to the on-premises network, not to other VPCs, thus achieving the isolation requirement. Additionally, using a Direct Connect gateway to propagate routes to all VPCs ensures that the on-premises network routes are available in these isolated route tables. Option A is incorrect because a Direct Connect virtual interface must be attached to a Direct Connect Gateway, which then associates with the Transit Gateway via a transit gateway attachment.

A VPN attachment is for VPN connections, not Direct Connect. Option D is incorrect because a single Transit Gateway route table for all attachments would allow VPC-to-VPC communication via automatically propagated routes. Option E is incorrect because VPC peering connections would create direct connectivity between VPCs, violating the isolation requirement.

Exam trap

The trap here is thinking that a single route table can isolate VPC traffic or that a Direct Connect virtual interface attaches directly to a Transit Gateway VPN attachment. In reality, separate route tables per VPC combined with route propagation from a Direct Connect gateway are needed to isolate VPCs while providing shared on-premises access.

Practice this question →

186

MCQhard

A media company runs a latency-sensitive streaming application on Amazon EC2 instances in a VPC. The application sends UDP traffic to multiple on-premises destinations via an AWS Transit Gateway with a VPN attachment. Users report occasional freezing. Network monitoring shows no packet loss on the VPN tunnel, but the application logs show out-of-order packets and high jitter. The company uses a single VPN tunnel with BGP dynamic routing over the public internet. The on-premises router has a 50ms latency to the AWS endpoint. The application requires low jitter and in-order delivery. What should a network engineer do to resolve the issue?

A.Add a second VPN tunnel to the same Transit Gateway to load balance traffic

B.Enable jumbo frames on the VPN tunnel to reduce packet overhead

C.Replace the VPN attachment with an AWS Direct Connect private VIF to provide a consistent path

D.Change the application to use TCP instead of UDP

AnswerC

Direct Connect provides consistent low latency and jitter.

Why this answer

UDP traffic over a single VPN tunnel over the internet can experience jitter and reordering due to variable network conditions. Using AWS Direct Connect provides a consistent, low-latency path that eliminates internet variability. Option A (multiple VPN tunnels) may not resolve jitter inherent to internet transit.

Option B (TCP instead of UDP) changes application protocol, not a network solution. Option D (enable jumbo frames) does not address jitter.

Practice this question →

187

Multi-Selecthard

A company has a VPC with multiple subnets spanning three Availability Zones. They have deployed an Application Load Balancer (ALB) in the VPC and need to ensure high availability and scalability for a web application. Which of the following are design considerations for implementing the ALB in this environment? (Choose THREE.)

Select 3 answers

A.Enable the ALB in at least two Availability Zones to provide high availability.

B.Remove an Availability Zone from the ALB if the targets in that AZ are unhealthy.

C.Configure the ALB to use subnets that span multiple Availability Zones.

D.Use VPC peering to connect the ALB to subnets in other VPCs.

E.Enable cross-zone load balancing to evenly distribute traffic across all targets.

AnswersA, B, E

ALB must have targets in multiple AZs to be highly available.

Why this answer

AWS requires an Application Load Balancer to be enabled in at least two Availability Zones to achieve high availability. If one AZ fails, the ALB can continue routing traffic to healthy targets in the remaining AZs, ensuring fault tolerance and compliance with the ALB's regional service model.

Exam trap

AWS often tests the misconception that subnets can span multiple Availability Zones or that VPC peering can directly integrate an ALB with subnets in another VPC, but both are architecturally invalid in AWS.

Practice this question →

188

MCQeasy

A company has an AWS Site-to-Site VPN connection between their on-premises network and a VPC. The VPN tunnel status shows 'UP'. However, instances in the VPC cannot ping an on-premises server at 192.168.1.10. Which step should be taken to troubleshoot?

A.Verify that the internet gateway is attached to the VPC

B.Verify that the VPC route table has a route to the on-premises network via the virtual private gateway

C.Verify that the security group for the instances allows outbound ICMP

D.Verify that the VPN tunnel is up on both ends

AnswerB

Without this route, traffic from VPC to on-premises is dropped.

Why this answer

Even though the VPN tunnel is 'UP', traffic from the VPC to the on-premises network must be routed through the virtual private gateway (VGW). If the VPC route table does not contain a route for the on-premises CIDR (e.g., 192.168.1.0/24) pointing to the VGW, the instances have no path to reach the on-premises server, regardless of tunnel status.

Exam trap

The trap here is that candidates see 'VPN tunnel status UP' and assume connectivity is fully functional, overlooking the critical requirement of a VPC route pointing to the virtual private gateway for traffic to traverse the tunnel.

How to eliminate wrong answers

Option A is wrong because an internet gateway is used for internet-bound traffic, not for traffic destined to an on-premises network over a VPN; the VPC can route to on-premises without an internet gateway. Option C is wrong because the issue is about reachability at the network layer (routing), not about firewall rules; outbound ICMP from the security group would be a secondary check only after routing is confirmed. Option D is wrong because the question explicitly states the VPN tunnel status shows 'UP', so the tunnel is already up on both ends; rechecking the tunnel status does not address the missing route.

Practice this question →

189

MCQhard

Refer to the exhibit. A Lambda function is attached to a VPC using the network interface eni-1234567890abcdef0. The Lambda function needs to send traffic to an on-premises server via a Direct Connect connection. The traffic is failing. Which setting on the network interface is most likely causing the issue?

A.The network interface is in a subnet that does not have a route to the Direct Connect.

B.The network interface has two private IP addresses.

C.The SourceDestCheck flag is enabled, which prevents the Lambda function from sending traffic that it is not the source or destination of.

D.The security group attached to the network interface may be blocking outbound traffic.

AnswerC

Lambda functions that forward traffic need to disable source/destination check.

Why this answer

Lambda functions attached to a VPC use elastic network interfaces (ENIs) with the Source/Destination Check flag enabled by default. This flag causes the ENI to drop any traffic where the ENI's IP address is not the source or destination of the packet. Since the Lambda function is sending traffic to an on-premises server via Direct Connect, the ENI is acting as an intermediate hop, and the flag must be disabled for the traffic to pass.

Exam trap

The ANS-C01 exam often tests the Source/Destination Check flag as a hidden default setting that candidates forget to disable when an ENI is used for forwarding traffic, leading them to incorrectly blame routing or security groups.

How to eliminate wrong answers

Option A is wrong because the subnet's route table can be configured with a route to the Direct Connect virtual interface (VIF) or Direct Connect Gateway, and the question does not indicate a missing route; the issue is at the ENI level. Option B is wrong because having two private IP addresses on an ENI does not inherently prevent outbound traffic; it is a common configuration for multi-homed workloads and does not affect source/destination checks. Option D is wrong because security groups are stateful and, by default, allow all outbound traffic; unless explicitly modified, they would not block the Lambda function's outbound traffic.

Practice this question →

190

MCQhard

Refer to the exhibit. A VPN connection is established between an on-premises network (10.0.0.0/16) and an AWS VPC (172.16.0.0/16). The on-premises network can ping the VPC's private IP addresses, but the VPC cannot ping the on-premises network's IP addresses. The VPC route table has a route to 10.0.0.0/16 pointing to the VGW. What is the MOST likely cause?

A.The VPN tunnels are not both in UP state

B.The VPN acceleration is disabled, causing high latency

C.The VPN connection is configured with static routes only and BGP is not used

D.The on-premises network does not have a route to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway

AnswerD

Without a return route, traffic from VPC reaches on-premises but replies are dropped.

Why this answer

The on-premises network can ping the VPC because the VPC route table has a route to 10.0.0.0/16 pointing to the virtual private gateway (VGW), so return traffic from the VPC is correctly forwarded. However, the VPC cannot ping the on-premises network because the on-premises router lacks a route back to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway (CGW). Without this return route, traffic from the VPC reaches the on-premises network, but the on-premises router drops the response packets as it does not know how to reach 172.16.0.0/16.

Exam trap

The ANS-C01 exam often tests the concept that a VPN tunnel being 'UP' does not guarantee bidirectional traffic; candidates mistakenly assume tunnel status implies full connectivity, but the real issue is often a missing return route on the on-premises side.

How to eliminate wrong answers

Option A is wrong because the VPN tunnels being in UP state is required for any traffic to flow; since the on-premises network can already ping the VPC, at least one tunnel must be UP. Option B is wrong because VPN acceleration (Accelerated Site-to-Site VPN) reduces latency but does not affect basic connectivity or routing; high latency would not prevent ping responses from being returned. Option C is wrong because using static routes versus BGP does not cause unidirectional connectivity; static routes can work correctly as long as both sides have proper routes.

The issue is the missing return route on the on-premises side, not the routing method.

Practice this question →

191

Multi-Selecthard

A company is troubleshooting connectivity issues between two VPCs that are peered using an inter-region VPC peering connection. The VPCs have the following CIDR blocks: VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Which THREE of the following are possible reasons for the connectivity failure?

Select 3 answers

A.The VPC CIDR blocks overlap.

B.The VPC peering connection is in a 'pending-acceptance' state.

C.The route tables in each VPC do not have routes pointing to the peer VPC's CIDR.

D.The network ACLs in VPC A are blocking inbound traffic from VPC B's CIDR.

E.The security group rules in VPC A do not allow inbound traffic from VPC B's CIDR.

AnswersC, D, E

Without routes, traffic will not be forwarded to the peering connection.

Why this answer

For inter-region VPC peering to function, each VPC must have explicit routes in its route tables pointing to the CIDR block of the peer VPC, with the VPC peering connection as the target. Without these routes, traffic destined for the peer VPC will not be forwarded over the peering link, causing connectivity failure.

Exam trap

The ANS-C01 exam often tests the misconception that overlapping CIDRs are the only cause of peering failures, but here the CIDRs are non-overlapping, so candidates must recognize that missing routes and security group/NACL misconfigurations are equally valid causes.

Practice this question →

192

MCQhard

An organization is using AWS Direct Connect with a private VIF to connect to a VPC. They want to extend connectivity to multiple VPCs in the same region without creating multiple private VIFs. Which solution should they implement?

A.Create VPC peering connections from the VPC with the Direct Connect VIF to the other VPCs.

B.Create a Direct Connect gateway and associate it with a Transit Gateway that is attached to the VPCs.

C.Provision separate private VIFs for each VPC.

D.Use a Transit VIF to connect directly to a Transit Gateway.

AnswerB

A Direct Connect gateway can be associated with multiple virtual private gateways or a Transit Gateway to connect to multiple VPCs.

Why this answer

A Direct Connect gateway allows you to associate a single private VIF with multiple VPCs in the same region by connecting to a Transit Gateway. The Transit Gateway then acts as a hub, enabling transitive routing between all attached VPCs without needing separate VIFs. This solution scales efficiently and avoids the complexity of managing multiple private VIFs.

Exam trap

The trap here is that candidates often confuse Transit VIFs with private VIFs, thinking a Transit VIF can directly connect to a Transit Gateway, but in reality, a Transit VIF always connects to a Direct Connect gateway, which then associates with a Transit Gateway.

How to eliminate wrong answers

Option A is wrong because VPC peering does not support transitive routing; you would need a full mesh of peering connections, and it does not leverage the Direct Connect private VIF to extend connectivity natively. Option C is wrong because provisioning separate private VIFs for each VPC defeats the requirement to avoid multiple private VIFs and increases cost and management overhead. Option D is wrong because a Transit VIF is used to connect to a Direct Connect gateway, not directly to a Transit Gateway; the Transit Gateway must be associated with the Direct Connect gateway, not directly attached via a Transit VIF.

Practice this question →

193

MCQeasy

A company is deploying a new web application on AWS. They need to distribute incoming HTTPS traffic across multiple EC2 instances in different Availability Zones. Which AWS service should they use?

A.Amazon Route 53

B.Amazon CloudFront

C.Application Load Balancer (ALB)

D.Network Load Balancer (NLB)

AnswerC

ALB operates at Layer 7, can terminate HTTPS, and distribute traffic across instances in multiple AZs.

Why this answer

The Application Load Balancer (ALB) is the correct choice because it operates at Layer 7 (HTTP/HTTPS) and can terminate TLS, inspect HTTPS headers, and route traffic based on content. It is designed to distribute incoming HTTPS traffic across multiple EC2 instances in different Availability Zones, providing health checks and automatic scaling.

Exam trap

The trap here is that candidates often confuse Layer 4 (NLB) with Layer 7 (ALB) and incorrectly choose NLB because it handles high throughput, but they miss that HTTPS requires application-layer inspection and TLS termination, which only ALB provides natively.

How to eliminate wrong answers

Option A is wrong because Amazon Route 53 is a DNS service that resolves domain names to IP addresses, not a traffic distributor for HTTPS requests; it cannot perform load balancing or health checks on EC2 instances. Option B is wrong because Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations and accelerates delivery, but it does not distribute traffic across EC2 instances in different Availability Zones; it can be used with an ALB but is not a substitute for a load balancer. Option D is wrong because Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) and does not understand HTTPS headers or perform TLS termination, making it unsuitable for distributing HTTPS traffic based on application-layer content.

Practice this question →

194

MCQeasy

A company has a VPC with both IPv4 and IPv6 CIDRs. They need to allow outbound IPv6 traffic from private subnets to the internet. What should they use?

A.An internet gateway attached to the VPC.

B.A customer-managed prefix list.

C.A NAT gateway in a public subnet.

D.An egress-only internet gateway.

AnswerD

Designed for outbound-only IPv6 traffic from private subnets.

Why this answer

An egress-only internet gateway (EIGW) is a horizontally scaled, redundant VPC component that allows outbound IPv6 traffic from instances in a VPC to the internet, while preventing the internet from initiating an IPv6 connection to those instances. It is specifically designed for IPv6 traffic and must be used with a route table entry that directs all outbound IPv6 traffic (::/0) to the EIGW. Unlike an internet gateway, an EIGW does not support inbound IPv6 connections, making it the correct choice for private subnets that need outbound-only IPv6 internet access.

Exam trap

The trap here is that candidates often confuse the egress-only internet gateway with a NAT gateway, assuming NAT can handle IPv6, or they incorrectly select an internet gateway thinking it can be restricted to outbound-only traffic, but AWS does not support such a configuration for IPv6.

How to eliminate wrong answers

Option A is wrong because an internet gateway supports both inbound and outbound IPv6 traffic, which would expose private subnet instances to inbound connections from the internet, violating the requirement for outbound-only access. Option B is wrong because a customer-managed prefix list is used to define a set of IP address ranges for route tables or security groups, not to provide internet connectivity or routing for IPv6 traffic. Option C is wrong because a NAT gateway is designed for IPv4 traffic only; it does not support IPv6 and cannot be used to route IPv6 traffic to the internet.

Practice this question →

195

MCQeasy

A company wants to deploy a web application on EC2 instances behind an Application Load Balancer (ALB). The application must support sticky sessions (session affinity). What configuration is required on the ALB?

A.Enable stickiness on the target group and specify a cookie duration

B.Use path-based routing

C.Configure health checks on the target group

D.Enable proxy protocol v2

AnswerA

Stickiness (session affinity) ensures the same client is routed to the same target.

Why this answer

Sticky sessions (session affinity) are enabled at the target group level on an Application Load Balancer. By enabling stickiness and specifying a cookie duration, the ALB generates a session cookie (AWSALB) that binds a client's session to a specific target for the duration, ensuring subsequent requests from the same client are routed to the same EC2 instance.

Exam trap

The trap here is confusing target group-level stickiness with listener-level routing rules (path-based) or connection metadata protocols (Proxy Protocol), leading candidates to select options that address different ALB features.

How to eliminate wrong answers

Option B is wrong because path-based routing controls which target group handles requests based on URL path patterns, not session stickiness. Option C is wrong because health checks determine target availability for routing traffic, but do not affect session affinity or cookie behavior. Option D is wrong because Proxy Protocol v2 is used to pass client connection information (source IP, port) to the backend, not to enable sticky sessions.

Practice this question →

196

Multi-Selectmedium

A company is deploying a web application that will be accessed over the internet. They want to use an Application Load Balancer (ALB) to distribute traffic across EC2 instances in multiple Availability Zones. Which TWO configurations are required to make the ALB internet-facing? (Choose TWO.)

Select 2 answers

A.Configure a security group that allows inbound traffic from 0.0.0.0/0.

B.Assign an Elastic IP address to the ALB.

C.Associate the ALB with private subnets only.

D.Associate the ALB with public subnets that have a route to an Internet Gateway.

E.Select 'Internet-facing' as the scheme when creating the ALB.

AnswersD, E

Required for internet-facing ALB.

Why this answer

An internet-facing ALB must be associated with public subnets that have a route to an Internet Gateway (IGW). This ensures the ALB's nodes receive public IP addresses and can accept traffic from the internet. Option E is correct because the scheme must be explicitly set to 'internet-facing' during creation; this determines whether the ALB gets public IP addresses and is reachable from the internet.

Exam trap

The trap here is that candidates confuse security group rules (Option A) or Elastic IP assignment (Option B) with the fundamental requirement of an internet-facing scheme and public subnet association, which are the only two configurations that actually make the ALB internet-facing.

Practice this question →

197

Multi-Selecthard

A company is migrating its on-premises data center to AWS using Direct Connect and a VPN connection as backup. The company has multiple VPCs connected via a Transit Gateway. They want to ensure high availability for the Direct Connect connection. Which TWO actions should be taken? (Choose TWO.)

Select 2 answers

A.Replace the VPN backup with a second Direct Connect connection

B.Enable jumbo frames on the Direct Connect connection

C.Use a single Direct Connect connection but with higher bandwidth

D.Configure BGP with multiple virtual interfaces on the Direct Connect connections

E.Provision a second Direct Connect connection at a different location

AnswersD, E

Correct; BGP allows dynamic failover between virtual interfaces.

Why this answer

Options D and E are correct. To achieve high availability for Direct Connect, you need redundant physical connections at different locations (Option E) and configure BGP with multiple virtual interfaces to enable active-active or active-passive failover (Option D). Option A is not required because a VPN backup already exists, and a second Direct Connect connection alone does not guarantee location diversity.

Option B (jumbo frames) does not affect availability, and Option C (higher bandwidth) does not provide redundancy.

Practice this question →

198

MCQhard

A network engineer is reviewing VPC Flow Logs for a VPC. The logs show that traffic from 10.0.1.5 to 10.0.2.10 on port 443 is being accepted and rejected intermittently. Both instances are in the same VPC. What is the most likely cause?

A.The security group on the destination instance is configured to allow inbound HTTPS but deny outbound traffic.

B.The network ACL is blocking traffic.

C.The route table is misconfigured.

D.The source instance's security group is denying outbound traffic.

AnswerB

Correct. A network ACL is stateless and requires both inbound and outbound rules to allow traffic. If outbound rules block response traffic, the flow will show intermittent ACCEPT and REJECT.

Why this answer

VPC Flow Logs show intermittent ACCEPT and REJECT for traffic from 10.0.1.5 to 10.0.2.10 on port 443. Since the traffic is within the same VPC, the route table is not involved (Option C is unlikely). Security groups are stateful, so even if the destination security group denies outbound traffic, return traffic for the established inbound connection is still allowed; thus Option A is incorrect.

The intermittent behavior is characteristic of a stateless network ACL (NACL). A NACL is applied at the subnet level and evaluates inbound and outbound rules independently. If the NACL allows inbound traffic but blocks outbound response traffic (or vice versa), the flow will be partially accepted (initial packets) and then rejected when return packets hit the blocking rule.

This matches the logs showing both ACCEPT and REJECT for the same flow. Therefore, the most likely cause is a misconfigured NACL (Option B).

Exam trap

The ANS-C01 exam often tests the distinction between stateful security groups and stateless network ACLs. Candidates may incorrectly assume that intermittent traffic issues are due to security group rules, but the key indicator is the 'intermittent' pattern—a hallmark of stateless firewall behavior where response traffic can be blocked if outbound rules are missing.

How to eliminate wrong answers

Option B is wrong because network ACLs are stateless and evaluate traffic in both directions independently; if a network ACL were blocking traffic, it would consistently reject packets, not intermittently, and the logs would show a clear pattern of 'REJECT' for all packets in a given direction. Option C is wrong because a misconfigured route table would cause traffic to be sent to a different target (e.g., an internet gateway or a different subnet) or be dropped entirely, resulting in consistent failure rather than intermittent acceptance and rejection. Option D is wrong because the source instance's security group controls outbound traffic from the source; if it denied outbound traffic, the source would never send packets to the destination, and the VPC Flow Logs would not show any 'ACCEPT' entries for the traffic from 10.0.1.5 to 10.0.2.10.

Practice this question →

199

MCQmedium

A company has an S3 bucket with the bucket policy shown. The VPC endpoint ID is correct. However, an EC2 instance in a private subnet in the same VPC cannot download objects from the bucket. What is a possible reason?

A.The EC2 instance does not have a route to the VPC endpoint

B.The bucket policy does not allow s3:ListBucket

C.The EC2 instance is accessing S3 via a NAT Gateway instead of the VPC endpoint

D.The VPC endpoint security group is blocking traffic

AnswerC

The policy only allows requests coming through the VPC endpoint; requests via NAT Gateway are denied.

Why this answer

The bucket policy likely includes a condition that restricts access to only requests originating from the VPC endpoint (e.g., `aws:sourceVpce`). If the EC2 instance in the private subnet routes traffic through a NAT Gateway instead of the VPC endpoint, the source IP will be the NAT Gateway's public IP, not the VPC endpoint's private IP, causing the condition to fail and the request to be denied. The instance can still reach S3 via the NAT Gateway, but the policy explicitly blocks non-endpoint traffic.

Exam trap

The ANS-C01 exam often tests the misconception that VPC endpoints always require security groups or that any route to S3 (including via NAT) will satisfy a bucket policy condition, when in fact the condition `aws:sourceVpce` specifically requires traffic to traverse the VPC endpoint.

How to eliminate wrong answers

Option A is wrong because the EC2 instance in a private subnet with a VPC endpoint automatically has a route to the endpoint via the endpoint's prefix list in the route table; no additional route is needed. Option B is wrong because downloading an object requires only `s3:GetObject` permission, not `s3:ListBucket`; the bucket policy likely already allows `s3:GetObject` for the VPC endpoint. Option D is wrong because VPC endpoint security groups only apply to interface endpoints (e.g., for services like EC2 API), not to gateway endpoints (like S3 or DynamoDB), which do not use security groups.

Practice this question →

200

MCQmedium

A global company wants to connect multiple VPCs across different AWS Regions using a hub-and-spoke model. The hub VPC contains shared services such as Active Directory and DNS. Which AWS service provides the most scalable and maintainable solution for this architecture?

A.AWS VPN CloudHub to interconnect all VPCs.

B.AWS Direct Connect gateway with virtual interfaces to each VPC.

C.VPC peering between each spoke VPC and the hub VPC.

D.AWS Transit Gateway with inter-Region peering attachments.

AnswerD

Transit Gateway provides a scalable hub-and-spoke architecture and supports inter-Region peering.

Why this answer

AWS Transit Gateway with inter-Region peering attachments is the most scalable and maintainable solution because it provides a central hub to connect multiple VPCs across different AWS Regions using a fully managed service. Inter-Region peering attachments allow transitive routing between all attached VPCs without requiring full mesh peering, and they support route propagation and centralized management of shared services like Active Directory and DNS. This architecture scales linearly as new VPCs or Regions are added, unlike VPC peering which requires individual non-transitive connections.

Exam trap

The trap here is that candidates often choose VPC peering (Option C) because it is a familiar and simple solution, but they overlook the non-transitive nature of VPC peering, which prevents the hub from routing traffic between spoke VPCs and requires a full mesh of peering connections for transitive communication.

How to eliminate wrong answers

Option A is wrong because AWS VPN CloudHub uses multiple VPN connections from remote networks to a single virtual private gateway, but it does not support connecting VPCs directly—it is designed for on-premises branch connectivity, not VPC-to-VPC routing across Regions. Option B is wrong because AWS Direct Connect gateway with virtual interfaces is used to connect on-premises networks to multiple VPCs in different Regions, but it does not provide transitive routing between VPCs themselves and is not designed for VPC-to-VPC hub-and-spoke connectivity. Option C is wrong because VPC peering is non-transitive, meaning each spoke VPC must be individually peered to the hub VPC, and it does not support inter-Region transitive routing through a single hub—each peering connection is a one-to-one relationship that cannot be used to route traffic between spoke VPCs via the hub.

Practice this question →

201

MCQhard

A network engineer is troubleshooting high latency on a Direct Connect connection. The engineer notices that the BGP session is flapping intermittently. The connection is a 1 Gbps dedicated connection with a single private VIF. The router configuration uses default BGP timers. What is the most likely cause of the flapping?

A.The MTU size is set to 9001 (jumbo frames) on the Direct Connect interface.

B.The link experiences occasional packet loss causing BGP hold timer expiration.

C.The BGP authentication key is mismatched between the customer router and AWS.

D.The Multi-Exit Discriminator (MED) value is set too high on the customer router.

AnswerB

Packet loss can cause keepalive messages to be lost, leading to hold timer expiry and BGP session reset.

Why this answer

B is correct because the BGP hold timer (default 90 seconds) expires when the link experiences intermittent packet loss, causing the BGP session to flap. This is a common issue on Direct Connect when the underlying physical link has transient errors or congestion, leading to missed keepalive messages and session resets.

Exam trap

The trap here is that candidates often confuse BGP session flapping with configuration errors (like authentication or MED) rather than recognizing that transient packet loss is the most common cause of hold timer expiration on a single physical link.

How to eliminate wrong answers

Option A is wrong because jumbo frames (MTU 9001) are supported on Direct Connect and do not cause BGP flapping; they would instead cause fragmentation or connectivity issues if mismatched. Option C is wrong because a BGP authentication key mismatch would prevent the session from establishing at all, not cause intermittent flapping. Option D is wrong because the MED value influences route selection between multiple paths, not BGP session stability; a high MED does not cause flapping.

Practice this question →

202

MCQeasy

A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is internet-facing and uses a public subnet. The EC2 instances are in private subnets. The application needs to be accessible from the internet. The security group for the ALB allows inbound HTTP and HTTPS from 0.0.0.0/0. The security group for the EC2 instances allows inbound traffic from the ALB's security group. The route tables for the private subnets have a default route to a NAT gateway. Users report that they cannot access the application. The ALB target group shows the instances as unhealthy. What is the MOST likely cause?

A.The security group for the EC2 instances does not allow inbound traffic from the ALB's security group on the health check port.

B.The ALB is deployed in a private subnet instead of a public subnet.

C.The ALB does not have an associated internet gateway route.

D.The NAT gateway is not correctly routing traffic from the instances to the internet.

AnswerA

Health checks fail if security group blocks traffic.

Why this answer

When using an Application Load Balancer (ALB), the target group health checks originate from the ALB's nodes. The security group for the EC2 instances must allow inbound traffic from the ALB's security group on the health check port, typically port 80 or 443. If this rule is missing, the health checks fail and the instances are marked unhealthy, preventing traffic from being forwarded.

Option B is wrong because the ALB is described as internet-facing and deployed in a public subnet. Option C is wrong because an internet gateway route is attached to the public subnet where the ALB resides, not to the ALB itself. Option D is wrong because the NAT gateway handles outbound traffic from the private subnets, not inbound health check traffic from the ALB.

Practice this question →

203

MCQeasy

A company wants to connect its on-premises data center to AWS using AWS Direct Connect. The company requires a dedicated 1 Gbps connection with low latency and high bandwidth for mission-critical workloads. Which type of Direct Connect interface should be used?

A.AWS Transit VIF

B.VPN Connection

C.Hosted Connection

D.Dedicated Connection

AnswerD

A dedicated connection provides a physical port dedicated to the customer.

Why this answer

A Dedicated Connection (Option D) is correct because it provides a physical, single-tenant Ethernet connection from the on-premises data center directly to AWS, offering dedicated 1 Gbps or 10 Gbps bandwidth with consistent low latency and high availability for mission-critical workloads. Unlike hosted connections, a dedicated connection is provisioned as a physical port at an AWS Direct Connect location, ensuring exclusive use and predictable performance without contention from other customers.

Exam trap

The trap here is that candidates confuse 'Dedicated Connection' with 'Hosted Connection' (Option C), mistakenly thinking a hosted connection provides the same dedicated bandwidth, but a hosted connection is a shared, multi-tenant link that cannot guarantee the same performance isolation or Service Level Agreement (SLA) as a dedicated physical port.

How to eliminate wrong answers

Option A is wrong because an AWS Transit VIF is a virtual interface type used to connect to an AWS Transit Gateway, not a physical connection type; it requires an existing Direct Connect connection (dedicated or hosted) to be created. Option B is wrong because a VPN Connection uses the public internet with IPSec encryption, introducing variable latency, potential packet loss, and bandwidth limitations that cannot guarantee the dedicated 1 Gbps low-latency requirement for mission-critical workloads. Option C is wrong because a Hosted Connection is a shared, multi-tenant connection provisioned by an AWS Direct Connect Partner, which does not provide the dedicated, single-tenant physical port and may have bandwidth contention or reduced performance guarantees compared to a dedicated connection.

Practice this question →

204

MCQmedium

A financial services company has a VPC with a public subnet and a private subnet. EC2 instances in the private subnet need to download patches from the internet. The company has a NAT gateway in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, instances cannot reach the internet. The NAT gateway is in an 'available' state and has an Elastic IP attached. The security group for the NAT gateway allows all outbound traffic. What is the most likely cause of the issue?

A.The security group for the NAT gateway is blocking inbound traffic from private instances

B.The NAT gateway is not provisioned with sufficient bandwidth

C.The NAT gateway does not have an IAM role to access the internet

D.The route table for the public subnet does not have a default route (0.0.0.0/0) pointing to an internet gateway

AnswerD

Correct. The NAT gateway resides in a public subnet. For the NAT gateway to forward traffic to the internet, the route table associated with that public subnet must have a default route (0.0.0.0/0) pointing to an internet gateway. Without this route, traffic from the NAT gateway cannot reach the internet.

Why this answer

The most likely cause is that the route table for the public subnet (where the NAT gateway resides) does not have a default route (0.0.0.0/0) pointing to an internet gateway. The NAT gateway needs this route to forward traffic from private instances to the internet. Option A is incorrect because security groups for NAT gateways do not block inbound traffic from private instances; they only control traffic to the NAT gateway itself.

Option B is incorrect because bandwidth provisioning is not related to connectivity; the NAT gateway can handle traffic up to its bandwidth limit. Option C is incorrect because NAT gateways do not require IAM roles to access the internet; they use Elastic IPs.

Practice this question →

205

MCQeasy

A company is deploying a VPC with IPv6 support. The VPC has a CIDR block of 10.0.0.0/16 and an assigned IPv6 CIDR block of 2600:1f16:xxxx:xxxx::/56. The company wants EC2 instances in a public subnet to be able to communicate with the internet using IPv6. Which configuration is necessary?

A.Attach a NAT gateway to the VPC and add a route for ::/0 to the NAT gateway in the public subnet route table.

B.Attach an internet gateway to the VPC and add a route for 0.0.0.0/0 to the internet gateway in the public subnet route table.

C.Set up a NAT64 translation service to convert IPv6 requests to IPv4.

D.Attach an egress-only internet gateway to the VPC and add a route for ::/0 to the egress-only internet gateway in the public subnet route table.

AnswerD

Provides outbound-only IPv6 internet access.

Why this answer

An egress-only internet gateway (EIGW) is the AWS-managed service designed to enable outbound-only IPv6 communication from a VPC to the internet. Since IPv6 addresses are globally unique and publicly routable, a NAT gateway (used for IPv4) is not needed; instead, the EIGW allows instances to initiate outbound traffic while preventing any unsolicited inbound connections. Adding a route for ::/0 to the EIGW in the public subnet route table directs all outbound IPv6 traffic through it.

Exam trap

The trap here is that candidates often confuse the egress-only internet gateway with a NAT gateway or assume that an internet gateway alone suffices for IPv6, forgetting that the internet gateway supports both inbound and outbound traffic, whereas the EIGW is specifically required for outbound-only IPv6 communication to prevent inbound connections.

How to eliminate wrong answers

Option A is wrong because a NAT gateway is used for outbound IPv4 traffic from private subnets and does not support IPv6; attaching it would not enable IPv6 internet access. Option B is wrong because adding a route for 0.0.0.0/0 (IPv4 default route) to an internet gateway only handles IPv4 traffic, not IPv6; the question specifically requires IPv6 communication. Option C is wrong because NAT64 translates IPv6 requests to IPv4, which is unnecessary here since the VPC already has an assigned IPv6 CIDR and the goal is direct IPv6 internet access, not translation to IPv4.

Practice this question →

206

MCQmedium

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. The company has a NAT gateway in a public subnet. The EC2 instance can connect to other instances in the VPC but cannot reach the internet. What is the most likely cause?

A.The security group of the EC2 instance blocks outbound HTTPS traffic.

B.The NAT gateway does not have an Elastic IP address.

C.The network ACL of the private subnet blocks inbound traffic from the NAT gateway.

D.The route table in the private subnet does not have a default route to the NAT gateway.

AnswerD

Missing default route prevents internet access.

Why this answer

For an EC2 instance in a private subnet to reach the internet via a NAT gateway, the private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway as the target. Without this route, traffic destined for the internet has no path to the NAT gateway, so the instance can communicate within the VPC but cannot reach external hosts. Option D correctly identifies this missing route as the most likely cause.

Exam trap

The ANS-C01 exam often tests the distinction between security groups, network ACLs, and route tables, and the trap here is that candidates assume a connectivity issue must be a firewall or ACL block, overlooking the fundamental requirement of a correct default route in the subnet's route table.

How to eliminate wrong answers

Option A is wrong because the EC2 instance is in a private subnet and cannot reach the internet at all; even if outbound HTTPS were blocked, the issue would be a specific protocol failure, not a complete lack of internet connectivity. Option B is wrong because a NAT gateway requires an Elastic IP address to function correctly; if it lacked one, it would not be able to communicate with the internet, but the question states the company has a NAT gateway, implying it is properly configured. Option C is wrong because the network ACL of the private subnet controls inbound traffic to the subnet, but the EC2 instance initiates outbound traffic to the internet; the NAT gateway's response traffic would be inbound, but the primary failure is the missing route for outbound traffic, not an ACL blocking inbound responses.

Practice this question →

207

MCQmedium

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC with public and private subnets. The ALB is in public subnets, and the web servers are in private subnets. Clients report intermittent connection errors. Investigation shows that the ALB is marking targets as unhealthy. What is the MOST likely cause?

A.The network ACL for the private subnets is blocking inbound traffic from the ALB.

B.The security group for the web servers does not allow inbound traffic from the internet.

C.The ALB is deployed in private subnets and cannot reach the internet.

D.The health check is configured to use the public IP address of the targets, but the targets are in private subnets without public IPs.

AnswerD

Health checks must target the private IP of the instances; using public IPs will fail.

Why this answer

When health checks are configured to use the public IP address of targets, the ALB attempts to reach the targets via the internet. Since the web servers are in private subnets without public IPs, the health check traffic cannot be routed to them, causing the ALB to mark them as unhealthy. Health checks must target private IP addresses within the VPC for instances in private subnets.

Exam trap

The trap here is that candidates often overlook that health checks must target private IPs within the VPC, not public IPs, and mistakenly focus on security group or ACL rules instead of the health check configuration.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and must allow both inbound and outbound traffic; however, the default network ACL allows all traffic, and even if custom rules were blocking, the ALB's health check traffic originates from its private IPs within the VPC, not from the internet, so the issue is not ACL blocking. Option B is wrong because the security group for web servers does not need to allow inbound traffic from the internet; it only needs to allow traffic from the ALB's security group or the ALB's private IPs, and the intermittent failures are due to health check misconfiguration, not internet access. Option C is wrong because the ALB is explicitly stated to be in public subnets, so it has internet connectivity; even if it were in private subnets, ALBs must be in public subnets to function correctly for internet-facing traffic.

Practice this question →

208

MCQhard

A company is implementing a hybrid network architecture with AWS Direct Connect and a VPN backup. The company has two Direct Connect connections from different providers terminating at two AWS Direct Connect locations, each connecting to a separate AWS Transit Gateway in the same region. The VPCs are attached to both transit gateways. The company needs to ensure that traffic from on-premises to VPCs uses the primary Direct Connect connection when available and fails over to the secondary Direct Connect connection, then to the VPN. How should the company configure routing to achieve this?

A.Configure BGP AS_PATH prepending on the secondary Direct Connect and VPN connections to make them less preferred than the primary Direct Connect.

B.Disable route propagation from the VPN to the transit gateway route tables, and rely on the Direct Connect connections only.

C.Configure equal-cost multipath (ECMP) routing across all three connections to load balance traffic.

D.Use static routes in the transit gateway route tables with higher metric values for the secondary Direct Connect and VPN.

AnswerA

AS_PATH prepending influences BGP best path selection.

Why this answer

BGP AS_PATH prepending on the secondary Direct Connect and VPN connections artificially increases the AS path length, making those routes less preferred in the BGP best-path selection process. This ensures that the primary Direct Connect connection is chosen for traffic from on-premises to VPCs when available, with automatic failover to the secondary Direct Connect and then to the VPN as the least preferred path.

Exam trap

The trap here is that candidates may think static routes with metrics can be used in transit gateway route tables to influence path selection, but BGP-based routing in hybrid networks requires manipulating BGP attributes like AS_PATH, not static route metrics.

How to eliminate wrong answers

Option B is wrong because disabling route propagation from the VPN would prevent the VPN from being used as a backup path, leaving no failover option if both Direct Connect connections fail. Option C is wrong because ECMP routing would load balance traffic across all three connections, which does not meet the requirement for a primary/backup failover order. Option D is wrong because transit gateway route tables do not support metric-based static routes for BGP-learned routes; static routes with higher metrics cannot be used to influence BGP path selection in this hybrid architecture.

Practice this question →

209

MCQmedium

A company is deploying a multi-VPC architecture with connectivity requirements. The network team needs to establish private connectivity between VPCs in the same AWS account and region, using services that can scale to 100 Gbps throughput. Which solution meets these requirements?

A.Use AWS PrivateLink with Network Load Balancers to connect VPCs

B.Deploy AWS Client VPN and configure routes between VPCs

C.Create an AWS Transit Gateway and attach all VPCs to it

D.Configure VPC peering connections between each pair of VPCs

AnswerC

Transit Gateway provides scalable connectivity up to 100 Gbps per attachment.

Why this answer

AWS Transit Gateway (TGW) acts as a regional hub-and-spoke router that can interconnect thousands of VPCs and on-premises networks, supporting burst throughput up to 100 Gbps per attachment. It simplifies multi-VPC connectivity by eliminating the need for full-mesh peering and provides centralized routing, making it the only option that meets both the scalability and private connectivity requirements.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering can scale to high throughput by simply adding more connections, but the trap here is that VPC peering has a per-connection bandwidth cap (typically 10 Gbps) and lacks transitive routing, making it unsuitable for high-throughput multi-VPC architectures compared to Transit Gateway's hub-and-spoke design.

How to eliminate wrong answers

Option A is wrong because AWS PrivateLink with Network Load Balancers is designed for service-to-service connectivity (e.g., exposing a service in one VPC to consumers in another), not for general VPC-to-VPC routing, and it does not scale to 100 Gbps aggregate throughput between multiple VPCs. Option B is wrong because AWS Client VPN is a remote access VPN solution for individual clients (e.g., laptops) to connect to AWS, not for private VPC-to-VPC connectivity, and it cannot handle 100 Gbps throughput. Option D is wrong because VPC peering connections are limited to a maximum of 10 Gbps per peering link (depending on instance type) and require a full-mesh topology for multiple VPCs, which does not scale to 100 Gbps aggregate throughput and becomes operationally complex.

Practice this question →

210

MCQmedium

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network team reports that they can ping the VPC's private IP addresses, but they cannot reach an internet-facing application hosted on an EC2 instance in a public subnet. The EC2 instance has a public IP and a security group allowing HTTP/HTTPS from 0.0.0.0/0. What is the most likely cause?

A.The route table in the public subnet does not have a default route to an internet gateway.

B.The security group is blocking traffic from the on-premises IP range.

C.The BGP session is not exchanging routes for the public IP range.

D.The private VIF does not route traffic to public IP addresses; the on-premises traffic to the public IP must traverse the internet.

AnswerD

A private VIF only carries traffic destined to private IP addresses in the VPC. Traffic to public IPs must go over the internet.

Why this answer

The issue is that the private VIF (private virtual interface) is designed to route traffic only between private IP addresses, not public IP addresses. Even though the EC2 instance has a public IP and the security group allows HTTP/HTTPS from anywhere, traffic from on-premises destined for the public IP of the EC2 instance will not traverse the Direct Connect private VIF because the private VIF does not route public IP traffic. Instead, that traffic would need to go over the internet.

Therefore, the most likely cause is that the private VIF does not route traffic to public IP addresses, as stated in option D. Option A is incorrect because the route table in the public subnet can have a default route to an internet gateway; that is not the issue. Option B is incorrect because the security group allows all inbound HTTP/HTTPS.

Option C is incorrect because BGP exchanges routes for prefixes advertised over the VIF, but even if routes were exchanged, the private VIF would not route public IP traffic.

Practice this question →

211

MCQeasy

A company is designing a VPC with public and private subnets. They want EC2 instances in private subnets to be able to access the internet for software updates. Which AWS service should they use?

A.AWS Direct Connect

B.Internet Gateway (IGW)

C.VPC Peering connection

D.NAT Gateway

AnswerD

A NAT Gateway enables outbound internet access for instances in private subnets.

Why this answer

A NAT Gateway enables EC2 instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT Gateway's Elastic IP address using source network address translation (SNAT), allowing them to reach public endpoints.

Exam trap

The ANS-C01 exam often tests the misconception that an Internet Gateway (IGW) can be used for private subnet outbound access, but the trap is that IGWs only work with public subnets that have a route to the IGW and instances with public IPs; private subnets require a NAT device for outbound-only internet access.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated private network connection from on-premises to AWS, not a mechanism for private subnet instances to access the internet. Option B is wrong because an Internet Gateway (IGW) is attached to a VPC and used for public subnets; it does not provide outbound-only internet access for private subnets—instances in private subnets cannot route directly to an IGW. Option C is wrong because VPC Peering connects two VPCs privately, it does not provide internet access; it only allows traffic between the peered VPCs.

Practice this question →

212

MCQmedium

A company has a VPN connection between an on-premises network and AWS using two tunnels for redundancy. The BGP sessions are established, but traffic is only flowing through one tunnel. The engineer wants to ensure both tunnels are actively used. What should be configured?

A.Enable load balancing on the VPN connection in the AWS console.

B.Configure static routes for the second tunnel.

C.Assign different BGP ASNs to each tunnel.

D.Advertise the same BGP prefixes over both tunnels from the on-premises router.

AnswerD

This allows AWS to load balance traffic across both tunnels.

Why this answer

When both tunnels advertise the same BGP prefixes, the AWS VPN endpoint will see equal-cost paths and load-balance traffic across both tunnels using ECMP (Equal-Cost Multi-Path) routing. This ensures active-active utilization of both tunnels, which is the standard design for AWS VPN redundancy.

Exam trap

The trap here is that candidates assume AWS VPN requires manual load balancing (Option A) or that static routes are needed for the second tunnel (Option B), when in fact BGP multipath with identical prefix advertisements is the correct method to achieve active-active utilization.

How to eliminate wrong answers

Option A is wrong because AWS VPN connections do not have a configurable 'load balancing' toggle in the console; traffic distribution is determined by BGP path selection, not a manual setting. Option B is wrong because adding static routes for the second tunnel would create a conflict with the dynamic BGP routes and could cause asymmetric routing or black-holing, as AWS prefers BGP over static routes. Option C is wrong because each VPN tunnel uses its own BGP session, but both sessions must use the same BGP ASN on the customer side (typically a private ASN); assigning different ASNs would break BGP peering or cause the tunnels to be treated as separate routing domains, preventing ECMP.

Practice this question →

213

Multi-Selecteasy

A network engineer needs to monitor network traffic in a VPC. Which TWO AWS services can capture and analyze VPC flow logs?

Select 2 answers

A.Amazon GuardDuty

B.Amazon S3

C.VPC Traffic Mirroring

D.Amazon CloudWatch Logs

E.AWS Config

AnswersB, D

Flow logs can be delivered to S3.

Why this answer

Amazon S3 is a correct destination for VPC Flow Logs because you can publish flow log data directly to an S3 bucket, where it can be stored, queried with Amazon Athena, or processed by other analytics tools. Amazon CloudWatch Logs is also a correct destination, allowing you to publish flow logs to a log group for real-time monitoring, metric filters, and integration with CloudWatch alarms or third-party solutions via subscription filters.

Exam trap

AWS often tests the misconception that VPC Traffic Mirroring is a type of flow log, but it is a separate feature for capturing full packet payloads, not the aggregated metadata logs that VPC Flow Logs provide.

Practice this question →

214

Multi-Selecteasy

A company is designing a hybrid network using AWS Direct Connect. Which TWO of the following are required to establish a private virtual interface (VIF) to a single VPC?

Select 2 answers

A.A Direct Connect Gateway to connect to the VPC.

B.A VLAN ID for the virtual interface.

C.A public IP address for the AWS side of the BGP session.

D.A BGP session with the AWS Direct Connect endpoint using public IPs.

E.A BGP session to exchange routing information.

AnswersB, E

VLAN ID is required to tag traffic.

Why this answer

A VLAN ID is required to create a private virtual interface (VIF) because it uniquely identifies the 802.1Q VLAN tag used to segregate traffic on the Direct Connect link. Without a VLAN ID, the physical connection cannot logically separate the private VIF from other virtual interfaces (e.g., public or transit VIFs) on the same circuit.

Exam trap

The ANS-C01 exam often tests the misconception that a Direct Connect Gateway is mandatory for any private VIF, but it is only required when connecting to multiple VPCs or using a transit VIF, not for a single VPC connection.

Practice this question →

215

Multi-Selecthard

A company is deploying a global application and wants to use AWS Global Accelerator to improve performance. The application runs behind an Application Load Balancer (ALB) in us-east-1. Which THREE components are part of a Global Accelerator deployment?

Select 3 answers

A.Route 53 hosted zones

B.Endpoint groups

C.AWS edge locations

D.Lambda@Edge functions

E.Two static anycast IP addresses

AnswersB, C, E

Endpoint groups define endpoints and traffic distribution.

Why this answer

Endpoint groups are a core component of AWS Global Accelerator that define the AWS Region and traffic routing for a listener. Each endpoint group contains one or more endpoints (such as an ALB, NLB, or EC2 instance) and allows you to control traffic distribution and health checking. In this scenario, the ALB in us-east-1 would be added to an endpoint group associated with that region.

Exam trap

The ANS-C01 exam often tests the misconception that Global Accelerator uses DNS-based routing like Route 53, but the key differentiator is that Global Accelerator relies on static anycast IPs and edge locations for traffic optimization, not DNS resolution.

Practice this question →

216

MCQhard

Refer to the exhibit. A subnet is created in VPC vpc-abcde but no explicit route table association is set. What is the default route for internet-bound traffic from this subnet?

A.Traffic is dropped because no explicit association is set.

B.Traffic goes through the Internet Gateway.

C.Traffic goes through the NAT Gateway nat-67890.

D.Traffic is dropped because no Internet Gateway is present.

AnswerC

The main route table has a route to the NAT Gateway.

Why this answer

When a subnet is created in a VPC without an explicit route table association, it is implicitly associated with the VPC's main route table. The main route table in this scenario includes a default route (0.0.0.0/0) pointing to NAT Gateway nat-67890, so internet-bound traffic from this subnet is directed through the NAT Gateway. This allows instances in private subnets to initiate outbound internet connections while preventing inbound traffic from the internet.

Exam trap

The ANS-C01 exam often tests the misconception that a subnet without an explicit route table association has no routing, when in fact it inherits the VPC's main route table, which may include a default route to a NAT Gateway or Internet Gateway.

How to eliminate wrong answers

Option A is wrong because the subnet is automatically associated with the VPC's main route table, so traffic is not dropped; it follows the routes in that table. Option B is wrong because the main route table's default route points to the NAT Gateway, not an Internet Gateway, and no Internet Gateway is listed in the route table. Option D is wrong because traffic is not dropped due to the absence of an Internet Gateway; it is routed through the NAT Gateway, which provides outbound internet access without requiring a direct Internet Gateway in the subnet's route table.

Practice this question →

217

MCQmedium

An organization needs to securely connect its on-premises data center to multiple VPCs in different AWS Regions. The on-premises network uses BGP. Which AWS service should be used to simplify routing and provide a single point of attachment for the on-premises router?

A.Direct Connect gateway with a private VIF.

B.AWS Transit Gateway with inter-Region peering attachments.

C.VPC Peering connections between each VPC and the on-premises network.

D.AWS Client VPN endpoint.

AnswerB

Centralized hub with BGP and multi-region support.

Why this answer

AWS Transit Gateway with inter-Region peering attachments is the correct choice because it provides a single point of attachment for the on-premises router, simplifying routing and connectivity to multiple VPCs across different AWS Regions. The Transit Gateway supports BGP over VPN connections or Direct Connect, allowing the on-premises network to peer with a single Transit Gateway, which then centrally manages inter-VPC and inter-Region traffic through peering attachments, eliminating the need for multiple separate connections.

Exam trap

The trap here is that candidates often confuse Direct Connect gateway with Transit Gateway, assuming a Direct Connect gateway can natively handle inter-Region routing, but it requires additional VPN or Transit Gateway attachments to achieve multi-Region connectivity, whereas Transit Gateway with peering attachments is the designed solution for this exact use case.

How to eliminate wrong answers

Option A is wrong because a Direct Connect gateway with a private VIF only provides connectivity to a single AWS Region or multiple VPCs in the same Region via a Direct Connect connection, but it does not natively support inter-Region routing or simplify multi-Region VPC attachment as a single point for the on-premises router. Option C is wrong because VPC Peering connections do not support transitive routing; each peering connection is a one-to-one relationship, requiring the on-premises router to establish separate BGP sessions and routing tables for each VPC, which does not simplify routing or provide a single point of attachment. Option D is wrong because AWS Client VPN endpoint is a remote access VPN solution for individual clients, not a site-to-site connectivity option for an on-premises data center router using BGP, and it cannot provide a single point of attachment for multiple VPCs across Regions.

Practice this question →

218

MCQmedium

A company is implementing a network architecture for a critical application that requires ultra-low latency between two Amazon EC2 instances. The instances are launched in two different Availability Zones within the same AWS Region. The network engineer needs to ensure that traffic between the instances uses the lowest latency path possible. The instances are placed in a cluster placement group. The application uses TCP. The engineer has configured the security groups to allow all traffic between the instances. However, latency is higher than expected. What should the engineer do to reduce latency?

A.Configure the instances to use their private IP addresses instead of public IPs for communication.

B.Enable Elastic Network Adapter (ENA) and enhanced networking on both instances.

C.Move the instances to the same subnet within the same Availability Zone.

D.Set up a VPC peering connection between the subnets in the two Availability Zones.

AnswerB

ENA reduces latency by offloading network processing.

Why this answer

Elastic Network Adapter (ENA) with enhanced networking provides lower latency and higher throughput by offloading network processing to hardware. While the cluster placement group minimizes network distance, it does not guarantee the lowest latency without ENA. Option A is incorrect because instances in the same VPC already communicate via private IPs by default.

Option C is incorrect because moving to the same AZ is not necessary and would reduce fault tolerance. Option D is incorrect because VPC peering does not improve latency within the same VPC.

Practice this question →

219

Multi-Selecthard

A company is using AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. The network engineer needs to ensure that traffic between VPC A and VPC B follows a specific path through a Network Virtual Appliance (NVA) in VPC C. Which TWO actions should the engineer take?

Select 2 answers

A.Associate VPC A's and VPC B's route tables with a different Transit Gateway route table that has a default route pointing to the VPC C attachment.

B.Add a static route in the Transit Gateway route table for VPC A's CIDR pointing to the VPC B attachment with a blackhole.

C.Enable route propagation for VPC A and VPC B attachments in the same Transit Gateway route table.

D.Add a specific route for VPC B's CIDR in the Transit Gateway route table used by VPC A, pointing to the VPC C attachment.

E.Create a VPC peering connection between VPC A and VPC B.

AnswersB, D

This prevents VPC A from directly reaching VPC B via the Transit Gateway.

Why this answer

Adding a static route in the Transit Gateway route table for VPC A's CIDR pointing to the VPC B attachment with a blackhole forces traffic destined to VPC B to be dropped at the Transit Gateway, preventing direct routing. Option D is correct because adding a specific route for VPC B's CIDR in the Transit Gateway route table used by VPC A, pointing to the VPC C attachment, ensures traffic from VPC A to VPC B is forwarded through the NVA in VPC C, enforcing the desired inspection path.

Exam trap

The trap here is that candidates often think enabling route propagation (Option C) is sufficient for traffic inspection, but it actually allows direct routing between VPCs, bypassing the NVA, unless specific static routes are added to override the propagated routes.

Practice this question →

220

MCQmedium

An engineer is reviewing VPC Flow Logs for connectivity issues between two EC2 instances (10.0.1.5 and 10.0.2.10) on TCP port 443. The first log entry shows ACCEPT, the second shows REJECT. What is the most likely cause of the REJECT?

A.The destination instance has an incorrect network interface configuration.

B.The network ACL is blocking the traffic due to an incorrect inbound rule.

C.The route table for the subnet does not have a route to the destination.

D.A security group rule is blocking the return traffic.

AnswerB

Correct. Network ACLs are stateless, so they require explicit inbound rules for return traffic. The REJECT on the return packet indicates a missing or incorrect inbound NACL rule.

Why this answer

The first log entry shows ACCEPT for the outbound SYN packet, indicating the initial connection attempt succeeded. The second REJECT indicates that the return SYN-ACK packet from 10.0.2.10 to 10.0.1.5 was dropped. Since security groups are stateful and automatically allow return traffic for established connections, they cannot cause this REJECT.

Network ACLs are stateless, so they require explicit inbound rules for return traffic. If the inbound rule on the NACL for the subnet of 10.0.2.10 does not allow the return traffic (e.g., using an ephemeral port range), it will be REJECTED. Therefore, option B is correct.

Exam trap

The ANS-C01 exam often tests the nuance that asymmetric routing can cause security groups to drop return traffic. Even though security groups are stateful, if the return packet takes a different path (e.g., different subnet or ENI) than the outbound packet, the security group on that interface may not recognize it as part of an established connection and will evaluate it against inbound rules. If no appropriate inbound rule exists, the packet is REJECTED.

Candidates frequently assume a REJECT on return traffic must be due to a stateless NACL, overlooking this asymmetric routing scenario.

How to eliminate wrong answers

Option A is wrong because an incorrect network interface configuration (e.g., wrong IP or subnet mask) would prevent the initial SYN packet from reaching the destination, but the first log entry shows ACCEPT, indicating the packet was delivered. Option B is wrong because network ACLs are stateless and would need explicit inbound rules for return traffic; if the NACL were blocking the return traffic, the first log entry (outbound) would still show ACCEPT, but the second REJECT could be due to a missing inbound NACL rule, but the question states the first entry shows ACCEPT and the second REJECT, which is more consistent with a stateful security group issue rather than a stateless NACL (NACLs would also require a rule for the ephemeral port range). Option C is wrong because if the route table lacked a route to the destination, the initial SYN packet would be dropped at the source subnet's router, resulting in a REJECT on the first log entry, not an ACCEPT.

Practice this question →

221

MCQhard

A company has a VPC (10.0.0.0/16) with two subnets: public (10.0.1.0/24) and private (10.0.2.0/24). They have an Application Load Balancer (ALB) in the public subnet that distributes traffic to EC2 instances in the private subnet. The ALB is internet-facing and has a security group that allows inbound HTTP/S from 0.0.0.0/0. The EC2 instances have a security group that allows inbound HTTP from the ALB's security group. Users report that they can access the application, but the application is slow and sometimes times out. The network engineer checks CloudWatch metrics and sees that the ALB's target response time is high. The engineer suspects that the EC2 instances are overwhelmed. Which action should the engineer take to improve performance?

A.Add a NAT gateway in the public subnet to reduce latency.

B.Replace the ALB with a Network Load Balancer to reduce overhead.

C.Increase the size of the EC2 instances in the private subnet.

D.Add EC2 instances in another Availability Zone and register them with the ALB.

AnswerD

Distributing load across AZs improves performance and availability.

Why this answer

Adding EC2 instances in another Availability Zone increases capacity and distributes traffic across multiple AZs, reducing the load on each instance and improving performance and fault tolerance. Option A is incorrect because a NAT gateway is for outbound internet access, not for reducing latency between ALB and targets. Option B is incorrect because an NLB does not automatically distribute traffic across AZs as effectively for HTTP applications and does not offload processing.

Option C is incorrect because simply increasing instance size (vertical scaling) may not provide the same benefits as horizontal scaling across AZs for handling variable loads.

Practice this question →

222

MCQhard

A company has a multi-account AWS Organizations setup with hundreds of VPCs across multiple regions. The network team needs to centralize outbound internet traffic through a set of inspection VPCs for security monitoring. Which solution is MOST scalable and cost-effective?

A.Use a Network Load Balancer in each VPC to distribute traffic to inspection appliances.

B.Create a Transit Gateway with a central inspection VPC that has a NAT Gateway and route all VPCs to the inspection VPC for egress.

C.Deploy a NAT Gateway in each VPC and route traffic directly to the internet.

D.Set up VPC peering between all VPCs and route traffic through a single VPC with an Internet Gateway.

AnswerB

Scalable, centralized, and cost-effective.

Why this answer

A Transit Gateway with a central inspection VPC centralizes egress traffic through a single NAT Gateway, eliminating the need for per-VPC NAT Gateways. This architecture scales horizontally by attaching hundreds of VPCs to the Transit Gateway and routing all 0.0.0.0/0 traffic to the inspection VPC, which is cost-effective as it reduces NAT Gateway hourly charges and data processing costs across multiple regions.

Exam trap

The trap here is that candidates may assume VPC peering can be used for transitive routing (Option D), but AWS explicitly prohibits transitive routing through VPC peering, making Transit Gateway the only scalable solution for hub-and-spoke egress with hundreds of VPCs.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer in each VPC distributes traffic to inspection appliances but does not centralize egress; it still requires per-VPC NAT Gateways or internet gateways, increasing cost and complexity without addressing the centralization requirement. Option C is wrong because deploying a NAT Gateway in each VPC directly contradicts the need to centralize outbound traffic; it distributes egress across all VPCs, increasing costs and losing centralized security monitoring. Option D is wrong because VPC peering does not support transitive routing (per AWS documentation, VPC peering is non-transitive), so routing traffic through a single VPC with an Internet Gateway would require full-mesh peering between all VPCs, which does not scale to hundreds of VPCs and violates the non-transitive peering rule.

Practice this question →

223

MCQeasy

A small company has a single VPC with one public subnet and one private subnet. They have a web server in the public subnet and a database server in the private subnet. The web server needs to access the database server on port 3306 (MySQL). The network engineer has configured the security group for the database server to allow inbound TCP port 3306 from the security group of the web server. However, the web server cannot connect to the database server. The network ACL for the private subnet is the default (allows all inbound and outbound). The web server can ping the database server's private IP. What is the MOST likely cause of the connection failure?

A.The web server cannot reach the private IP of the database server because it is in a different subnet

B.The network ACL for the private subnet is blocking inbound traffic on port 3306

C.The security group for the database server is not allowing inbound traffic from the web server's security group

D.The MySQL service on the database server is not running or not listening on port 3306

AnswerD

Correct; the application layer is the most likely issue.

Why this answer

The database server's security group is correctly configured to allow inbound traffic from the web server's security group on port 3306. The network ACL for the private subnet is default allow, so it is not blocking traffic. The web server can ping the database server's private IP, indicating network connectivity exists.

Therefore, the issue is that the MySQL service on the database server is not running or not listening on port 3306. Option D is correct.

Exam trap

Remember that security groups are stateful and automatically allow return traffic. The default network ACL allows all inbound and outbound traffic. If ping works but a specific port connection fails, the application service may not be running.

Practice this question →

224

MCQeasy

A company wants to provide internet access to instances in a public subnet. Which component must be attached to the VPC and have a route to it in the subnet's route table?

A.Transit Gateway

B.Virtual Private Gateway

C.NAT Gateway

D.Internet Gateway

AnswerD

Internet Gateway enables internet access for public subnets.

Why this answer

An Internet Gateway (IGW) is a horizontally scaled, redundant component that allows communication between a VPC and the internet. For instances in a public subnet to have outbound internet access and be reachable from the internet, the IGW must be attached to the VPC, and the subnet's route table must include a default route (0.0.0.0/0) pointing to the IGW as the target.

Exam trap

The trap here is that candidates confuse the NAT Gateway (which provides outbound-only internet access for private subnets) with the Internet Gateway (which provides bidirectional internet access for public subnets), leading them to select Option C for a public subnet scenario.

How to eliminate wrong answers

Option A is wrong because a Transit Gateway is used to interconnect multiple VPCs and on-premises networks, not to provide direct internet access to instances; it does not perform NAT or have a public IP. Option B is wrong because a Virtual Private Gateway is used to establish VPN connections from on-premises networks to a VPC, not to provide internet access; it cannot route traffic to the internet. Option C is wrong because a NAT Gateway enables outbound internet access for instances in private subnets, but it does not allow inbound traffic from the internet and is not used for public subnets; public subnets require an Internet Gateway.

Practice this question →

225

MCQmedium

A company is migrating a legacy application that requires static IP addresses for its clients' firewall whitelisting. The application will be hosted on EC2 instances behind a Network Load Balancer (NLB) in a private subnet. Which approach should the company use to provide static IP addresses for outbound traffic?

A.Assign Elastic IPs to the EC2 instances

B.Use an internet-facing NLB with Elastic IPs

C.Use a VPC endpoint for the application

D.Deploy a NAT Gateway in a public subnet with an Elastic IP

AnswerD

NAT Gateway with an Elastic IP provides a static source IP for outbound traffic from private subnets.

Why this answer

A NAT Gateway in a public subnet with an Elastic IP provides a static source IP address for outbound traffic from private subnets. Since the EC2 instances are in a private subnet behind an NLB, they cannot directly reach the internet; the NAT Gateway translates their private IPs to the Elastic IP, which clients can whitelist. This ensures consistent outbound IPs without exposing the instances to inbound traffic.

Exam trap

The trap here is that candidates confuse inbound static IPs (NLB with Elastic IPs) with outbound static IPs, or mistakenly think Elastic IPs on instances work in private subnets without a NAT device.

How to eliminate wrong answers

Option A is wrong because assigning Elastic IPs to EC2 instances in a private subnet does not provide outbound internet access; Elastic IPs only work for instances in public subnets with an internet gateway, and private subnets lack a direct route to the internet. Option B is wrong because an internet-facing NLB with Elastic IPs handles inbound traffic, not outbound; it cannot provide a static source IP for outbound connections initiated by the instances. Option C is wrong because a VPC endpoint is used for private connectivity to AWS services (e.g., S3, DynamoDB) over the AWS network, not for general outbound internet traffic to external clients.

Practice this question →