CCNA Network Implementation Questions — Page 4 of 6

226

Multi-Selecteasy

A company is setting up AWS Site-to-Site VPN for connectivity between its on-premises network and AWS VPC. They want to ensure the VPN tunnel is highly available. Which THREE components should be configured? (Choose THREE.)

Select 3 answers

A.A single VPN connection with one tunnel

B.BGP dynamic routing over the VPN tunnels

C.Static routing instead of BGP

D.Two VPN tunnels per VPN connection

E.A second customer gateway device on-premises

AnswersB, D, E

Correct; BGP allows automatic failover between tunnels.

Why this answer

Options B, D, and E are correct. BGP dynamic routing enables automatic failover between VPN tunnels, ensuring high availability. Two VPN tunnels per VPN connection provide redundant paths in case one tunnel fails.

A second customer gateway device on-premises eliminates the single point of failure at the on-premises side. Option A is incorrect because a single tunnel does not provide redundancy. Option C is incorrect because static routing does not support automatic failover like BGP does.

Practice this question →

227

Multi-Selectmedium

A company is designing a hybrid network using AWS Direct Connect. The company has a single 1 Gbps dedicated connection and wants to connect to multiple VPCs in the same region. Which THREE steps are necessary to achieve this connectivity?

Select 3 answers

A.Create a Direct Connect gateway.

B.Create a private virtual interface for each VPC.

C.Create a public virtual interface for each VPC.

D.Attach the VPCs to the transit gateway.

E.Create a transit virtual interface and associate it with a transit gateway.

AnswersA, D, E

A Direct Connect gateway can connect to multiple VPCs.

Why this answer

A Direct Connect gateway acts as a central hub that allows a single private virtual interface to connect to multiple VPCs in the same or different AWS regions. Without a Direct Connect gateway, a private virtual interface can only connect to a single VPC. By using a Direct Connect gateway, you can associate it with multiple VPCs (either directly or via a transit gateway), enabling the desired multi-VPC connectivity over the single 1 Gbps dedicated connection.

Exam trap

The trap here is that candidates often confuse the need for multiple private virtual interfaces (one per VPC) with the correct architecture, not realizing that a Direct Connect gateway combined with a transit gateway enables a single private virtual interface to serve multiple VPCs, and that a transit virtual interface is required to connect the Direct Connect gateway to the transit gateway.

Practice this question →

228

MCQmedium

A company is deploying a new VPC with both public and private subnets. The public subnet hosts an internet-facing Application Load Balancer (ALB), and the private subnet hosts EC2 instances running a web application. The EC2 instances need to download updates from the internet, but they must not be directly accessible from the internet. Which combination of steps should a network engineer implement to meet these requirements?

A.Create a NAT Gateway in a public subnet, and add a default route (0.0.0.0/0) to the NAT Gateway in the private subnet's route table.

B.Launch a proxy server in the public subnet and configure the private instances to use it for outbound traffic.

C.Set up a VPN connection to an on-premises network and route all internet traffic through the VPN.

D.Attach an Internet Gateway to the VPC and add a default route (0.0.0.0/0) to the Internet Gateway in the private subnet's route table.

AnswerA

This allows outbound internet access while blocking inbound connections.

Why this answer

A NAT Gateway in a public subnet allows EC2 instances in private subnets to initiate outbound traffic to the internet (e.g., for updates) while preventing any unsolicited inbound connections from the internet. Adding a default route (0.0.0.0/0) to the NAT Gateway in the private subnet's route table directs all outbound internet traffic through the NAT Gateway, which translates the private IPs to the NAT Gateway's Elastic IP. This meets the requirement of internet access for downloads without direct internet accessibility.

Exam trap

AWS often tests the misconception that an Internet Gateway in a private subnet's route table provides outbound-only access, but in reality, an Internet Gateway enables bidirectional traffic, making instances publicly reachable if they have public IPs or if the route is present.

How to eliminate wrong answers

Option B is wrong because a proxy server in the public subnet is an alternative but not the simplest or most AWS-native solution; it adds management overhead and a single point of failure, whereas a NAT Gateway is fully managed and highly available. Option C is wrong because a VPN connection to an on-premises network routes traffic through the corporate network, which does not provide direct internet access for the EC2 instances unless the on-premises network itself has internet connectivity and is configured to forward traffic, adding unnecessary complexity and latency. Option D is wrong because attaching an Internet Gateway and adding a default route to it in the private subnet's route table would make the EC2 instances directly accessible from the internet (since the Internet Gateway allows bidirectional traffic), violating the requirement that they must not be directly accessible.

Practice this question →

229

Multi-Selecteasy

Which TWO of the following are valid options for implementing network segmentation in a VPC?

Select 2 answers

A.Security Groups

B.Subnets

C.Route Tables

D.NAT Gateway

E.Internet Gateway

AnswersA, B

Security groups act as virtual firewalls for instances.

Why this answer

Security Groups (A) are stateful virtual firewalls that operate at the instance level (ENI), allowing you to control inbound and outbound traffic based on rules. They are a valid mechanism for network segmentation because you can assign different Security Groups to different instances or groups of instances to isolate traffic between tiers (e.g., web, app, database). Subnets (B) provide network segmentation at the VPC subnet level by dividing the VPC's IP address range into smaller segments, each associated with a specific Availability Zone and route table, enabling logical separation of resources.

Exam trap

AWS often tests the misconception that Route Tables or NAT Gateways provide segmentation, but they are routing and translation services, not access control boundaries; the trap is confusing traffic direction with traffic filtering.

Practice this question →

230

Multi-Selecthard

Which TWO of the following are characteristics of an AWS Network Load Balancer (NLB)?

Select 2 answers

A.Supports SSL offloading

B.Supports routing based on HTTP headers

C.Preserves the source IP address of the client

D.Operates at Layer 7 of the OSI model

E.Can handle millions of requests per second

AnswersC, E

NLB preserves the client IP.

Why this answer

Network Load Balancers operate at Layer 4 and preserve the client source IP address by default. When a client sends a request, the NLB forwards the packet with the original source IP intact, unlike Application Load Balancers which replace it with their own IP. This is critical for applications that require client IP logging or security filtering.

Exam trap

The trap here is that candidates confuse the capabilities of Network Load Balancers with Application Load Balancers, assuming NLBs support Layer 7 features like SSL offloading or HTTP header routing, when in fact NLBs are strictly Layer 4 devices.

Practice this question →

231

MCQmedium

A company is implementing an AWS Client VPN endpoint to provide remote access to its VPC resources. The company's on-premises network uses a split-tunneling configuration to route only corporate traffic through the VPN. The Client VPN endpoint is associated with a single subnet in the VPC. Users report that they can connect to the Client VPN but cannot reach resources in the VPC. The Client VPN endpoint's security group allows all traffic. What is the MOST likely cause of this issue?

A.The security group associated with the Client VPN endpoint does not allow inbound traffic from the client CIDR.

B.The authorization rules do not grant access to the target subnets.

C.The route table of the subnet where the Client VPN endpoint is attached does not have a route to the VPC CIDR.

D.The Client VPN endpoint is configured with full-tunneling instead of split-tunneling.

AnswerC

Without a route, traffic from clients won't reach VPC resources.

Why this answer

The Client VPN endpoint is attached to a subnet. For clients to reach resources in the VPC, the subnet's route table must have a route to the VPC CIDR. Without this route, traffic from the VPN clients cannot reach the VPC resources, even though the VPN connection is established.

Option A is incorrect because the security group for the Client VPN endpoint already allows all traffic, so inbound rules are not the issue. Option B is incorrect because authorization rules control access to specific target networks, but the fundamental routing issue prevents any traffic from reaching the VPC. Option D is incorrect because split-tunneling is about routing client traffic; the routing issue here is on the AWS side, not the client side.

Practice this question →

232

MCQmedium

An organization is migrating to AWS and needs to connect multiple VPCs in different AWS regions using a hub-and-spoke topology. The hub VPC will host centralized services. Which solution is most cost-effective and provides high throughput?

A.Deploy a software VPN appliance in the hub VPC and connect each spoke VPC with VPN tunnels.

B.Create VPC peering connections between the hub VPC and each spoke VPC.

C.Establish Direct Connect connections from each VPC to a central on-premises location.

D.Set up AWS Transit Gateway with attachments to each VPC.

AnswerB

VPC peering is cost-effective and high throughput for hub-and-spoke across regions.

Why this answer

VPC peering connections provide high-throughput, low-latency connectivity between VPCs using the AWS global network, with no bandwidth limits and no single point of failure. For a hub-and-spoke topology with a limited number of VPCs, VPC peering is the most cost-effective solution as it incurs no hourly or per-GB data transfer charges beyond standard inter-region data transfer costs, unlike Transit Gateway which has hourly attachment fees. This makes it ideal for organizations migrating to AWS that need simple, direct connectivity without the complexity or cost of additional appliances or transit infrastructure.

Exam trap

The trap here is that candidates often choose AWS Transit Gateway (Option D) because it is explicitly marketed for hub-and-spoke topologies, but they overlook the cost implications for small-scale deployments where VPC peering is more cost-effective and provides equivalent throughput.

How to eliminate wrong answers

Option A is wrong because deploying a software VPN appliance in the hub VPC introduces a single point of failure, adds latency due to encryption/decryption overhead, and incurs ongoing costs for the EC2 instance and licensing, making it less cost-effective and lower throughput than native AWS peering. Option C is wrong because Direct Connect connections from each VPC to a central on-premises location would require each VPC to have its own Direct Connect virtual interface and associated router, which is extremely expensive, complex to manage, and does not directly connect VPCs to each other—it forces traffic through on-premises, adding latency and defeating the purpose of a cloud-native hub-and-spoke topology. Option D is wrong because AWS Transit Gateway, while designed for hub-and-spoke architectures, incurs hourly attachment fees per VPC and per-GB data transfer charges, making it more expensive than VPC peering for a small number of VPCs; it is only cost-effective at scale (e.g., hundreds of VPCs) or when centralized routing policies are required.

Practice this question →

233

Multi-Selecthard

A company is designing a multi-account AWS environment using AWS Transit Gateway. They want to centralize network management and ensure that VPCs in different accounts can communicate. Which THREE steps are required to achieve this? (Select THREE.)

Select 3 answers

A.Create a Transit Gateway in the central networking account

B.Use AWS Resource Access Manager (RAM) to share the Transit Gateway with other accounts

C.Create a separate Transit Gateway in each account and peer them together

D.Create a Transit Gateway route table and associate VPC attachments

E.Create a VPC peering connection between each VPC and the Transit Gateway

AnswersA, B, D

A central Transit Gateway is created in the networking account.

Why this answer

The Transit Gateway must be created in a central networking account to serve as the hub for all VPC traffic. This centralizes routing and simplifies network management across the multi-account environment.

Exam trap

The trap here is that candidates might think each account needs its own Transit Gateway (Option C) or that VPC peering is required to connect to the Transit Gateway (Option E), when in fact a single shared Transit Gateway with VPC attachments is the correct approach.

Practice this question →

234

Multi-Selecthard

A company is migrating a legacy application to AWS. The application uses multicast traffic between servers. The company needs to support multicast in the AWS VPC. Which TWO solutions can the network engineer recommend? (Choose TWO.)

Select 2 answers

A.Deploy a third-party virtual firewall or router that supports multicast inside the VPC.

B.Use VPC endpoints for multicast support.

C.Use VPC peering connections to allow multicast traffic between VPCs.

D.Use a transit gateway with multicast domain configuration.

E.Use AWS Direct Connect to extend the on-premises multicast domain.

AnswersA, D

Virtual appliances can handle multicast routing.

Why this answer

A third-party virtual firewall or router appliance (e.g., from vendors like Palo Alto Networks or Cisco) can be deployed in the VPC and configured to forward multicast traffic using protocols such as IGMP and PIM. This allows the legacy application to continue using multicast within the VPC without native AWS multicast support. Option D is correct because AWS Transit Gateway now supports multicast domains, enabling you to create a multicast group and associate subnets, allowing multicast traffic to flow between attached VPCs and VPN connections.

Exam trap

The trap here is that candidates often assume VPC peering or Direct Connect can carry multicast traffic, but AWS explicitly blocks multicast and broadcast at the hypervisor level, so only Transit Gateway multicast domains or third-party appliances can solve this requirement.

Practice this question →

235

MCQeasy

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block to the VPC. Which action should they take?

A.Request an IPv6 CIDR block from your regional internet registry and associate it with the VPC.

B.Enable IPv6 on the subnets directly without associating a VPC CIDR.

C.Manually assign a /56 IPv6 CIDR block to the VPC.

D.Associate an Amazon-provided IPv6 CIDR block with the VPC.

AnswerD

Amazon provides a /56 block from their pool.

Why this answer

Amazon VPC supports IPv6 through an Amazon-provided IPv6 CIDR block that is automatically allocated from Amazon's pool of global unicast addresses. You cannot bring your own IPv6 CIDR or manually assign one; the only supported method is to associate an Amazon-provided /56 IPv6 CIDR block with the VPC. This enables dual-stack networking, allowing resources to communicate over both IPv4 and IPv6.

Exam trap

The trap here is that candidates assume they can bring their own IPv6 address space (like with IPv4) or manually configure the CIDR, but AWS only supports Amazon-provided IPv6 CIDR blocks for VPCs.

How to eliminate wrong answers

Option A is wrong because AWS does not support bringing your own IPv6 CIDR from a regional internet registry; you must use an Amazon-provided IPv6 block. Option B is wrong because IPv6 cannot be enabled on subnets without first associating an IPv6 CIDR block with the VPC; subnets inherit the VPC's IPv6 CIDR. Option C is wrong because you cannot manually assign a /56 IPv6 CIDR; AWS automatically allocates the /56 block from its own pool when you request an Amazon-provided IPv6 CIDR.

Practice this question →

236

MCQeasy

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. They want to add a second Direct Connect connection for redundancy. What is the MINIMUM number of virtual interfaces required to achieve active-active failover for the VPC?

A.Two transit virtual interfaces (one on each connection)

B.One private virtual interface and one transit virtual interface

C.Two private virtual interfaces (one on each connection)

D.One private virtual interface

AnswerC

Correct; two VIFs allow BGP to provide active-active failover.

Why this answer

For active-active failover to a VPC using Direct Connect, you need at least two private virtual interfaces (VIFs), one on each Direct Connect connection. This allows both connections to be used simultaneously for traffic load balancing, and if one fails, the other can carry all traffic. Option C is correct because it specifies two private VIFs.

Option A (two transit VIFs) is incorrect because transit VIFs connect to a Direct Connect Gateway, not directly to a VPC. Option B (one private and one transit) is incorrect because transit VIFs do not provide direct VPC connectivity, and mixing types does not help. Option D (one private VIF) lacks redundancy.

Practice this question →

237

MCQeasy

A company has a VPC with an Application Load Balancer (ALB) in front of a fleet of EC2 instances. The security group for the EC2 instances must allow traffic only from the ALB. Which source should be specified in the security group inbound rule?

A.The ALB's public IP address

B.The subnet CIDR block of the ALB's subnets

C.The ID of the ALB's security group

D.The VPC CIDR block

AnswerC

Referencing the ALB's security group as a source ensures only traffic from the ALB is allowed.

Why this answer

You can reference the ALB's security group ID as the source in the EC2 instances' security group inbound rule. This allows traffic from any network interface that is associated with the ALB's security group, regardless of the ALB's IP addresses or subnets. This is the recommended AWS best practice for controlling traffic between an ALB and its target instances, as it automatically adapts to changes in the ALB's underlying infrastructure.

Exam trap

The trap here is that candidates often assume they need to use the ALB's IP addresses or subnet CIDR, not realizing that AWS security groups can reference other security groups as a source, which is the most secure and scalable method for this scenario.

How to eliminate wrong answers

Option A is wrong because the ALB does not have a single public IP address; it uses a fully qualified domain name (FQDN) that resolves to multiple public IP addresses that can change over time. Option B is wrong because specifying the subnet CIDR block of the ALB's subnets would allow traffic from any resource in those subnets, not just the ALB, violating the principle of least privilege. Option D is wrong because the VPC CIDR block would allow traffic from any resource in the entire VPC, including other EC2 instances or services, not just the ALB.

Practice this question →

238

MCQeasy

A network engineer is analyzing VPC Flow Logs for a VPC with CIDR 10.0.0.0/16. The exhibit shows a sample log entry. The engineer notices that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted. However, the application team reports that the connection is failing. What is the most likely reason for the disconnect?

A.The security groups are blocking the traffic.

B.The route tables are incorrectly configured, causing packet loss.

C.The flow logs are misconfigured and not capturing all traffic.

D.The application layer is failing to establish a proper connection.

AnswerD

Flow logs only show network-level acceptance; application issues are not captured.

Why this answer

The VPC Flow Logs show that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted (ACCEPT record), which indicates that the network layer (security groups, network ACLs, and routing) is permitting the traffic. Since the application team reports the connection is failing, the issue must be at a higher layer, specifically the application layer (e.g., TLS handshake failure, certificate mismatch, or the application not listening on port 443). Flow logs capture only network-layer metadata (IP, port, protocol, action) and cannot detect application-layer errors.

Exam trap

AWS often tests the distinction between network-layer acceptance (ACCEPT in flow logs) and application-layer success, trapping candidates who assume an ACCEPT record guarantees a successful connection.

How to eliminate wrong answers

Option A is wrong because if security groups were blocking the traffic, the flow log entry would show a REJECT or DROP action, not ACCEPT. Option B is wrong because incorrect route tables would cause packet loss or unreachability, which would also result in DROP or no flow log entry for the destination, not an ACCEPT record. Option C is wrong because the flow log entry is present and shows ACCEPT, indicating the logs are capturing traffic correctly; misconfiguration would result in missing or incomplete logs, not a false ACCEPT.

Practice this question →

239

MCQhard

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a CIDR of 10.0.0.0/16 attached to the transit gateway. They also have a Direct Connect virtual interface attached to the transit gateway. The on-premises network can reach some VPCs but not the VPC with CIDR 10.0.0.0/16. The transit gateway route table has a static route for the on-premises CIDR and a route propagation from the VPC attachment. What is the most likely issue?

A.The transit gateway has reached the maximum number of attachments

B.The VPC CIDR overlaps with the on-premises CIDR

C.The transit gateway route table does not have a route to the on-premises network

D.The VPC attachment is not associated with the transit gateway route table

AnswerB

Overlapping CIDRs cause routing issues in a transit gateway.

Why this answer

The most likely issue is that the VPC CIDR (10.0.0.0/16) overlaps with the on-premises CIDR. When CIDR blocks overlap, the transit gateway cannot distinguish between destinations in the VPC and on-premises, leading to routing conflicts. This explains why the on-premises network can reach other VPCs with non-overlapping CIDRs but not this VPC.

The static route for the on-premises CIDR and the propagated route from the VPC attachment both exist in the transit gateway route table, but the overlap causes the transit gateway to forward traffic inconsistently or drop it. Options A, C, and D are incorrect: A) The transit gateway has no such attachment limit; C) The route table does have a route to the on-premises network via the static route; D) The VPC attachment is associated and propagating routes.

Practice this question →

240

Multi-Selecteasy

A company is setting up a new VPC and needs to ensure that instances in the VPC can resolve DNS names within AWS (e.g., ec2-203-0-113-25.compute-1.amazonaws.com). Which TWO configurations are required? (Select TWO.)

Select 2 answers

A.Set the VPC's 'enableDnsSupport' attribute to true

B.Set the VPC's 'enableDnsHostnames' attribute to true

C.Configure the Amazon Route 53 Resolver to forward queries to the VPC DNS

D.Create a public hosted zone in Amazon Route 53 and associate it with the VPC

E.Create a custom DHCP option set with the domain-name-servers option set to the VPC DNS IP

AnswersA, B

This enables DNS resolution through the Amazon DNS server.

Why this answer

Setting the VPC's 'enableDnsSupport' attribute to true (Option A) ensures that the VPC uses the Amazon-provided DNS server (the VPC DNS Resolver at the base VPC CIDR +2 address) to resolve DNS queries. This is required for instances to resolve public AWS DNS names like ec2-203-0-113-25.compute-1.amazonaws.com, as the VPC DNS Resolver handles both public and private DNS resolution within AWS.

Exam trap

The ANS-C01 exam often tests the misconception that enabling only 'enableDnsSupport' is sufficient, but the trap here is that 'enableDnsHostnames' must also be set to true for instances to receive and resolve public DNS hostnames, making both attributes required for the described scenario.

Practice this question →

241

MCQmedium

Refer to the exhibit. A VPC endpoint for S3 is created as a Gateway endpoint. The route tables rtb-11111111 and rtb-22222222 are associated with the endpoint. An EC2 instance in a subnet associated with rtb-11111111 cannot access S3 via the endpoint. What is the most likely cause?

A.The route table rtb-11111111 does not have a route to the S3 prefix list with the target as the VPC endpoint.

B.The endpoint policy denies access to S3 from the instance's IAM role.

C.The security group on the EC2 instance does not allow outbound traffic to the S3 prefix list.

D.The VPC does not have DNS resolution enabled for the endpoint.

AnswerA

Without this route, traffic to S3 does not go through the endpoint.

Why this answer

A Gateway VPC Endpoint for S3 works by adding a route in the subnet's route table that points the S3 prefix list (com.amazonaws.region.s3) to the endpoint ID (vpce-xxx). Without this specific route, traffic destined for S3 from the subnet associated with rtb-11111111 will follow the default route (e.g., an Internet Gateway or NAT Gateway) instead of being routed through the endpoint. Since the endpoint is only associated with rtb-11111111 and rtb-22222222, but rtb-11111111 lacks the required prefix list route, traffic from that subnet cannot reach S3 via the endpoint.

Exam trap

The ANS-C01 exam often tests the distinction between associating a route table with a Gateway Endpoint and actually adding the route to the S3 prefix list — candidates mistakenly think association alone is sufficient, but the route entry is mandatory for traffic to flow through the endpoint.

How to eliminate wrong answers

Option B is wrong because an endpoint policy controls access based on the IAM principal and S3 actions, but the question states the instance cannot access S3 at all, which is a routing issue, not a policy denial; a policy denial would typically result in an AccessDenied error, not a complete inability to reach S3. Option C is wrong because security groups do not filter traffic to a prefix list; they filter based on IP addresses or CIDR blocks, and S3 prefix lists resolve to multiple IP ranges, but the fundamental issue is that traffic is not even being routed to the endpoint, not that it is blocked by a security group rule. Option D is wrong because DNS resolution for a Gateway Endpoint is not required; Gateway Endpoints use prefix lists and route tables, not DNS names — DNS resolution is relevant for Interface Endpoints (e.g., for services like DynamoDB or API Gateway) where private DNS names are used.

Practice this question →

242

Matchingmedium

Match each AWS networking monitoring or troubleshooting tool to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Capture IP traffic information for security and troubleshooting

Monitor network performance metrics like throughput and latency

Test network path between two resources and identify configuration issues

Copy network traffic for content inspection or security analysis

Trace requests through distributed applications, including network calls

Why these pairings

The correct matches are: VPC Flow Logs ↔ IP traffic capture, AWS CloudWatch Logs ↔ centralized log monitoring, AWS CloudTrail ↔ API activity recording. Common confusions include swapping VPC Flow Logs with CloudTrail, or CloudWatch Logs with VPC Reachability Analyzer.

Practice this question →

243

Multi-Selectmedium

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) in multiple Availability Zones. Which TWO configurations are required to achieve high availability?

Select 2 answers

A.The ALB must be configured with subnets in at least two Availability Zones

B.The ALB must be internet-facing

C.At least three EC2 instances must be registered with the ALB

D.A NAT gateway must be deployed in each Availability Zone

E.Cross-zone load balancing must be enabled on the ALB

AnswersA, B

Multiple AZs provide redundancy.

Why this answer

The ALB must be configured with subnets in at least two Availability Zones to remain available if one AZ fails. Option B is correct because an internet-facing ALB is required to accept traffic from the internet; an internal ALB would not be accessible. Option C is incorrect because high availability does not require three instances; two instances (one per AZ) can provide high availability.

Option D is incorrect because NAT gateways are not required for ALB high availability; they are used for outbound internet access from private subnets. Option E is incorrect because cross-zone load balancing is enabled by default, but it is not a requirement for high availability; high availability is achieved by having instances in multiple AZs.

Practice this question →

244

Multi-Selecteasy

Which TWO of the following are valid methods to connect an on-premises network to an Amazon VPC? (Select TWO.)

Select 2 answers

A.AWS Direct Connect

B.AWS Site-to-Site VPN

C.VPC peering connection

D.VPC endpoint

E.Internet Gateway

AnswersA, B

Provides a dedicated private connection.

Why this answer

AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet for consistent latency and higher bandwidth. This is a valid method for connecting an on-premises network to a VPC, as it establishes a direct physical link that can be associated with a virtual interface to a VPC.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering or VPC endpoints can be used for on-premises connectivity, but these services are strictly for inter-VPC or service-to-VPC communication within AWS, not for extending an on-premises network.

Practice this question →

245

Multi-Selecthard

A company is deploying a new VPC with public and private subnets. The VPC will host web servers in the public subnet and database servers in the private subnet. The web servers need to access the internet for updates, and the database servers need to receive traffic only from the web servers. Which THREE components are essential for this architecture?

Select 3 answers

A.NAT gateway in the public subnet

B.Network ACL for subnets

C.Internet gateway

D.VPC endpoint for S3

E.Security groups for web and database servers

AnswersB, C, E

Network ACLs are essential for subnet-level security, controlling traffic between public and private subnets.

Why this answer

An internet gateway (IGW) is essential to allow web servers in the public subnet to directly access the internet. Security groups are essential to control traffic between web and database servers, ensuring only web servers can access the database. Network ACLs are essential for subnet-level traffic control, such as allowing inbound traffic from the public subnet to the private subnet while denying other inbound traffic.

A NAT gateway is not essential because the database servers do not require outbound internet access (only web servers need internet for updates). A VPC endpoint for S3 is not essential as there is no requirement to access S3.

Exam trap

Candidates often mistakenly think a NAT gateway is required for the private subnet, but the database servers do not need internet access. Additionally, they may overlook Network ACLs as essential because security groups alone can allow traffic between web and database instances, but Network ACLs provide subnet-level control required by the architecture.

Practice this question →

246

Multi-Selecthard

A company is setting up a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is established, but traffic is not flowing. Which THREE configuration items should be checked?

Select 3 answers

A.Route tables in the VPC and on-premises router.

B.Security group rules for the EC2 instances.

C.NAT gateway configuration in the VPC.

D.Network ACL rules for the subnets.

E.Internet gateway attachment to the VPC.

AnswersA, B, D

Routes are required for traffic forwarding.

Why this answer

Route tables in both the VPC and the on-premises router must have entries directing traffic for the remote network (e.g., the on-premises CIDR in the VPC route table, and the VPC CIDR in the on-premises route table) toward the VPN gateway or the VPN tunnel interface. Without these routes, packets have no path to reach the other side, even if the tunnel itself is up. This is a fundamental requirement for any Site-to-Site VPN to forward traffic.

Exam trap

The trap here is that candidates assume a 'UP' tunnel status guarantees traffic flow, but AWS explicitly tests that routing, security groups, and network ACLs are separate layers that must all be correctly configured for end-to-end connectivity.

Practice this question →

247

MCQeasy

Refer to the exhibit. The bucket policy shown is applied to an S3 bucket. A VPC endpoint for S3 is created in a VPC with CIDR 10.0.0.0/16. An EC2 instance in the VPC tries to access an object in the bucket using the VPC endpoint. The request fails. What is the most likely reason?

A.The bucket policy does not allow s3:ListBucket.

B.The condition uses aws:SourceIp, which does not work with VPC endpoint traffic.

C.The EC2 instance does not have an IAM role that allows s3:GetObject.

D.The VPC endpoint does not have a route table associated with the instance's subnet.

AnswerB

aws:SourceIp is not applicable for VPC endpoint requests; use aws:SourceVpce instead.

Why this answer

The bucket policy uses the `aws:SourceIp` condition key, which is not supported for traffic originating from a VPC endpoint. When requests are made through a VPC endpoint, the source IP address is replaced by the endpoint's private IP, making `aws:SourceIp` ineffective. To restrict access based on the VPC endpoint, you must use the `aws:SourceVpce` or `aws:SourceVpc` condition keys instead.

Exam trap

The ANS-C01 exam often tests the distinction between `aws:SourceIp` (which works for internet-based traffic) and `aws:SourceVpce`/`aws:SourceVpc` (which are required for VPC endpoint traffic), trapping candidates who assume all condition keys work universally with VPC endpoints.

How to eliminate wrong answers

Option A is wrong because the request is for accessing an object (s3:GetObject), not listing the bucket (s3:ListBucket), so the absence of s3:ListBucket permission is irrelevant to the failure. Option C is wrong because the bucket policy itself denies the request based on the condition, so even if the EC2 instance had an IAM role allowing s3:GetObject, the explicit deny in the bucket policy would override it. Option D is wrong because a missing route table association would cause a connectivity failure (e.g., timeout), not an access denied error; the question states the request fails, which aligns with a policy denial rather than a routing issue.

Practice this question →

248

MCQhard

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network uses BGP to advertise a route for 10.0.0.0/8. The VPC CIDR is 10.1.0.0/16. The company wants to ensure that all traffic from the VPC to on-premises uses the Direct Connect connection, but if the Direct Connect fails, traffic should fail over to a VPN connection. Which configuration achieves this?

A.Create a static route in the VPC route table pointing to the VPN with a metric of 100, and let BGP propagate the Direct Connect route.

B.Configure a BGP local preference of 200 on the Direct Connect VIF and 100 on the VPN connection, and use the same ASN for both.

C.Set the MED attribute on the Direct Connect VIF to 100 and on the VPN to 200.

D.Configure AS path prepend on the Direct Connect side to advertise a longer AS path.

AnswerB

Higher local preference is preferred; thus Direct Connect will be primary and VPN backup.

Why this answer

B is correct because BGP local preference is an administrative weight used to prefer one path over another within the same AS. By setting a higher local preference (200) on the Direct Connect VIF and a lower value (100) on the VPN, the on-premises router will prefer the Direct Connect path for outbound traffic. If the Direct Connect fails, the BGP session drops, and the VPN route with the lower local preference becomes active, providing failover.

Using the same ASN for both connections ensures the routes are compared as equal under BGP best-path selection.

Exam trap

The trap here is that candidates often confuse MED and local preference, incorrectly assuming MED controls outbound path selection, when in fact local preference is the correct attribute for influencing traffic leaving an AS, while MED influences inbound traffic from a neighboring AS.

How to eliminate wrong answers

Option A is wrong because a static route in the VPC route table with a higher metric does not influence BGP path selection on the on-premises side; the question requires controlling which path on-premises uses to send traffic back to the VPC, not the VPC's outbound routing. Option C is wrong because the MED (Multi-Exit Discriminator) attribute is used to influence inbound traffic from a neighboring AS, not outbound path selection from the on-premises router; setting MED on the Direct Connect VIF to 100 and VPN to 200 would actually make the VPN more preferred for inbound traffic to on-premises, which is the opposite of the desired behavior. Option D is wrong because AS path prepend makes a route less preferred by lengthening the AS path, so prepending on the Direct Connect side would make the Direct Connect path less attractive, causing traffic to prefer the VPN instead of using Direct Connect as the primary path.

Practice this question →

249

Multi-Selecteasy

Which TWO components are required when configuring a transit gateway to connect multiple VPCs and an on-premises network via Direct Connect? (Choose 2)

Select 2 answers

A.Internet gateway (IGW)

B.Transit Gateway association with the Direct Connect gateway

C.Virtual private gateway (VGW)

D.Customer gateway (CGW)

E.Direct Connect gateway

AnswersB, E

Transit Gateway association with the Direct Connect gateway is required.

Why this answer

When using Transit Gateway with Direct Connect, you need a Direct Connect gateway, and the Transit Gateway must be associated with the Direct Connect gateway. A virtual private gateway (VGW) is not used with Transit Gateway; it is used with a VPC alone. A customer gateway is used for VPN, not Direct Connect.

An internet gateway is for public internet traffic.

Practice this question →

250

Multi-Selecteasy

Which TWO of the following are valid methods to connect an on-premises network to an Amazon VPC over a private, dedicated connection? (Select TWO.)

Select 2 answers

A.AWS Direct Connect Gateway

B.AWS Direct Connect

C.AWS Client VPN

D.VPC Peering

E.AWS VPN CloudHub

AnswersA, B

Extends Direct Connect to multiple VPCs.

Why this answer

AWS Direct Connect Gateway allows you to connect an on-premises network to multiple VPCs in different AWS regions over a single private, dedicated connection. AWS Direct Connect provides a dedicated private network link from your on-premises data center to AWS, bypassing the public internet for lower latency and increased security.

Exam trap

The trap here is that candidates confuse 'private, dedicated connection' with any VPN-based solution, but AWS Direct Connect is the only option that provides a physical, dedicated link not traversing the public internet.

Practice this question →

251

MCQhard

A company has a large AWS environment with hundreds of VPCs connected via a Transit Gateway. The network team is implementing a new hub-and-spoke architecture where all traffic between VPCs must be inspected by a centralized firewall appliance in a shared services VPC. The firewall appliance is a third-party virtual appliance that supports VRF-like segmentation. The network engineer has configured the Transit Gateway with separate route tables for each VPC, and the shared services VPC is associated with all route tables. The firewall appliance is deployed in the shared services VPC with two ENIs: one in a 'trust' subnet and one in an 'untrust' subnet. The trust subnet is used for traffic coming from spoke VPCs, and the untrust subnet is used for traffic going to other spoke VPCs. The firewall appliance performs stateful inspection and returns traffic to the Transit Gateway via the correct ENI. However, after implementation, traffic between two spoke VPCs (VPC A and VPC B) is being dropped. The engineer verifies that the Transit Gateway route tables have static routes for each spoke VPC CIDR pointing to the shared services VPC attachment. The spoke VPCs have routes to each other's CIDR via the Transit Gateway. The firewall logs show that traffic from VPC A reaches the trust ENI, but the firewall is unable to send traffic to VPC B because it does not have a route to VPC B's CIDR. What is the most likely cause?

A.The shared services VPC attachment is not propagating routes to the Transit Gateway route tables.

B.The security group for the firewall's untrust ENI is blocking outbound traffic.

C.The Transit Gateway route table for VPC A does not have a route for VPC B's CIDR.

D.The route table for the untrust subnet does not have a route to VPC B's CIDR pointing to the Transit Gateway.

AnswerD

The untrust subnet needs a route to return traffic to the Transit Gateway. Without it, the firewall cannot send traffic to VPC B.

Why this answer

The firewall's untrust subnet route table must have a route pointing to the Transit Gateway for VPC B's CIDR. The firewall receives traffic from VPC A on its trust ENI, processes it, and then sends it out the untrust ENI. Without a route in the untrust subnet's route table directing traffic for VPC B's CIDR to the Transit Gateway, the firewall cannot forward the traffic back to the Transit Gateway for delivery to VPC B, causing the drop.

Exam trap

The trap here is that candidates often focus on Transit Gateway route tables and forget that the subnet route tables within the shared services VPC must also be configured to route traffic back to the Transit Gateway, especially when using a firewall with separate ENIs for trust and untrust subnets.

How to eliminate wrong answers

Option A is wrong because the shared services VPC attachment does not need to propagate routes to the Transit Gateway route tables; the static routes in the Transit Gateway route tables already point to the shared services VPC attachment for spoke-to-spoke traffic. Option B is wrong because the security group for the firewall's untrust ENI would block traffic at the firewall level, but the issue is that the firewall cannot send traffic due to a missing route, not that traffic is blocked by a security group. Option C is wrong because the Transit Gateway route table for VPC A does have a route for VPC B's CIDR pointing to the shared services VPC attachment, as verified by the engineer; the problem lies in the subnet route table within the shared services VPC.

Practice this question →

252

MCQhard

A company has a production VPC with CIDR 10.0.0.0/16. They have an internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones. The ALB distributes traffic to a fleet of EC2 instances in private subnets. The EC2 instances need to access an Amazon S3 bucket to retrieve configuration files. The company wants to minimize data transfer costs and ensure that traffic to S3 does not traverse the internet. A network engineer created a Gateway VPC Endpoint for S3 in the VPC and added a route in the public subnet route tables pointing to the endpoint. However, the EC2 instances still cannot access the S3 bucket. The security groups for the EC2 instances allow outbound HTTPS to 0.0.0.0/0. The NACLs are default (allow all). The S3 bucket policy allows access from the VPC endpoint. What is the MOST likely reason the EC2 instances cannot access S3?

A.The Gateway VPC Endpoint is in a different region than the S3 bucket

B.The security group for the EC2 instances does not allow outbound traffic to the S3 prefix list

C.The S3 bucket policy does not include a condition for the VPC endpoint

D.The route to the Gateway VPC Endpoint was added only to public subnets, not to private subnets

AnswerD

Correct; the route must be in the private subnet route table for EC2 instances to use the endpoint.

Why this answer

The Gateway VPC Endpoint for S3 must have a route in the route tables of the subnets where the EC2 instances reside. The engineer added the route only to public subnet route tables, not the private subnets. Therefore, traffic from the EC2 instances to S3 still uses the default route (0.0.0.0/0) via NAT Gateway or Internet Gateway, not the VPC endpoint.

Option A is incorrect because the endpoint is in the same region. Option B is incorrect because the security group allows outbound HTTPS to all destinations. Option C is incorrect because the S3 bucket policy includes the necessary condition.

Exam trap

A common trap is to think that adding a route to any subnet is sufficient. However, the route must be in the route table of the subnet where the instance resides. Public subnets have routes to the internet gateway, but private subnets need explicit routes to the gateway endpoint.

Practice this question →

253

Multi-Selecteasy

Which TWO of the following are true about AWS VPC endpoints? (Choose two.)

Select 2 answers

A.Gateway Endpoints can be used to access Amazon S3 and DynamoDB.

B.Interface Endpoints are free of charge.

C.Gateway Endpoints use AWS PrivateLink.

D.Both Gateway and Interface Endpoints require a NAT gateway.

E.Interface Endpoints are powered by AWS PrivateLink.

AnswersA, E

Only S3 and DynamoDB have Gateway Endpoints.

Why this answer

Gateway VPC endpoints allow private connectivity to Amazon S3 and DynamoDB without traversing the internet, using route table entries rather than private IP addresses. This is the only AWS service pair supported by Gateway Endpoints, making them a cost-effective and simple solution for these two services.

Exam trap

The trap here is that candidates often confuse Gateway Endpoints with Interface Endpoints, assuming both use PrivateLink or that Gateway Endpoints support more than just S3 and DynamoDB.

Practice this question →

254

MCQeasy

A company wants to use AWS Direct Connect to establish a dedicated network connection from their on-premises data center to AWS. They need to connect to a VPC in the us-east-1 region. Which of the following is a required step in the setup process?

A.Attach a Transit Gateway to the VPC.

B.Configure CloudFront to route traffic through the Direct Connect.

C.Create a site-to-site VPN connection as a backup.

D.Create a private virtual interface and attach it to a Virtual Private Gateway.

AnswerD

This is the standard procedure for Direct Connect private VIF.

Why this answer

To establish a Direct Connect connection to a VPC, you must create a private virtual interface (VIF) and attach it to a Virtual Private Gateway (VGW) that is attached to the VPC. The private VIF carries traffic over the dedicated connection and uses BGP to exchange routes between the on-premises network and the VPC via the VGW. This is the core requirement for routing traffic from the Direct Connect link into a VPC.

Exam trap

AWS often tests the misconception that a Transit Gateway is mandatory for Direct Connect, but the correct requirement is a Virtual Private Gateway attached to the VPC, not a Transit Gateway.

How to eliminate wrong answers

Option A is wrong because a Transit Gateway is not required for a single VPC connection; it is used to interconnect multiple VPCs or VPNs, and attaching it is optional. Option B is wrong because CloudFront is a content delivery network (CDN) and does not route traffic through Direct Connect; Direct Connect is a Layer 2/3 dedicated link, not a CDN service. Option C is wrong because a site-to-site VPN is not a required step; it is an optional backup for redundancy and is not mandatory for the Direct Connect setup process.

Practice this question →

255

Multi-Selectmedium

Which TWO of the following are requirements for establishing an AWS Direct Connect private virtual interface? (Choose two.)

Select 2 answers

A.Jumbo frames support (MTU 9001).

B.A public IP address for the VIF.

C.A public BGP ASN.

D.A BGP session between the customer router and the AWS device.

E.A VLAN ID that is unique within the Direct Connect connection.

AnswersD, E

BGP is used to exchange routes.

Why this answer

A BGP session between the customer router and the AWS device is a fundamental requirement for establishing a private virtual interface. The private VIF uses BGP to exchange routing information (typically a /30 or /31 subnet) between the on-premises network and the VPC, enabling dynamic route advertisement and failover. Without this BGP session, the VIF cannot be activated or used for traffic.

Exam trap

The ANS-C01 exam often tests the misconception that a public BGP ASN is mandatory for all Direct Connect virtual interfaces, but private VIFs can use private ASNs (from the 64512–65535 range) without issue.

Practice this question →

256

Multi-Selecteasy

A network engineer is designing a Direct Connect solution with a public VIF and a private VIF. The private VIF will connect to a VPC via a Direct Connect Gateway. Which TWO of the following statements are correct regarding this setup? (Choose 2.)

Select 2 answers

A.The private VIF can be used without a virtual interface termination device on the customer side

B.The public VIF can be used to connect to a VPC via a Direct Connect Gateway

C.The private VIF can be used to access Amazon S3 over a private IP address

D.The Direct Connect Gateway allows the private VIF to connect to multiple VPCs in different AWS Regions

E.The public VIF can be used to access AWS public services such as Amazon S3 over Direct Connect

AnswersD, E

Direct Connect Gateway enables multi-region connectivity.

Why this answer

A Direct Connect Gateway enables a private VIF to connect to multiple VPCs, even across different AWS Regions, by acting as a transit hub. The gateway uses a single private VIF to route traffic to up to 10 VPCs (by default) in any region, provided the VPCs are associated via virtual private gateways and the appropriate route tables are configured.

Exam trap

The ANS-C01 exam often tests the misconception that a public VIF can be used to connect to a VPC via a Direct Connect Gateway, but in reality, Direct Connect Gateway only supports private VIFs, and public VIFs are strictly for accessing AWS public services over public IP addresses.

Practice this question →

257

MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet to download software updates. The company has a NAT gateway in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, the EC2 instance cannot access the internet. The network engineer verifies that the NAT gateway has an Elastic IP, the security group for the EC2 instance allows outbound HTTPS traffic, and the network ACL for the private subnet allows inbound and outbound ephemeral ports. What is the most likely cause of the issue?

A.The security group attached to the NAT gateway does not allow outbound traffic.

B.The route table for the public subnet does not have a route to an internet gateway.

C.The route table for the private subnet does not have a route to the NAT gateway.

D.The NAT gateway does not support UDP traffic.

AnswerB

The public subnet must have a default route to an internet gateway for the NAT gateway to reach the internet.

Why this answer

The NAT gateway resides in the public subnet, which must have a route table with a default route (0.0.0.0/0) pointing to an internet gateway (IGW) for the NAT gateway to forward traffic to the internet. Without this route, the NAT gateway cannot reach the IGW, so traffic from the private subnet EC2 instance fails even though the private subnet route is correctly configured. The security group and network ACL settings are irrelevant if the NAT gateway itself lacks internet connectivity.

Exam trap

The ANS-C01 exam often tests the misconception that the private subnet route alone is sufficient, distracting candidates from verifying the public subnet’s route to the internet gateway, which is a prerequisite for NAT gateway functionality.

How to eliminate wrong answers

Option A is wrong because NAT gateways do not have security groups; they are controlled by network ACLs and route tables only. Option C is wrong because the question explicitly states the private subnet route table already has a default route (0.0.0.0/0) pointing to the NAT gateway, so this is not the issue. Option D is wrong because NAT gateways support TCP, UDP, and ICMP traffic; the problem is not protocol-specific.

Practice this question →

258

MCQeasy

A network engineer is troubleshooting connectivity between two EC2 instances in the same VPC but different subnets. The instances can ping each other's private IP addresses, but traffic on TCP port 443 fails. What is the most likely cause?

A.VPC Flow Logs misconfiguration.

B.Internet gateway not attached to the VPC.

C.Security group or network ACL rules blocking port 443.

D.Missing route in the route table.

AnswerC

Port 443 is likely blocked by a firewall rule.

Why this answer

Since the instances can ping each other, ICMP traffic is working, which rules out routing issues and confirms that the instances are reachable at Layer 3. TCP port 443 failing specifically indicates that a firewall rule is blocking the HTTPS traffic. Security groups are stateful and operate at the instance level, while network ACLs are stateless and operate at the subnet level; either can block port 443 while allowing ICMP, making this the most likely cause.

Exam trap

The ANS-C01 exam often tests the distinction between stateful security groups and stateless network ACLs, and the trap here is that candidates assume ping success means all Layer 4 traffic is fine, ignoring that security groups and ACLs can selectively block specific ports while allowing others.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs are a monitoring feature that captures metadata about traffic but do not block or filter traffic; misconfiguration would only affect logging, not connectivity. Option B is wrong because an internet gateway is only required for traffic destined to or from the internet, not for communication between instances within the same VPC, even across subnets. Option D is wrong because a missing route would prevent all traffic between the subnets, including ICMP pings, which are working; the VPC's main route table or subnet-specific route tables already have local routes for intra-VPC communication.

Practice this question →

259

MCQhard

A company has a VPC with public and private subnets across two Availability Zones. The private subnets require outbound internet access for updates, but must not be directly reachable from the internet. The company has a NAT gateway in each public subnet. Security team reports that instances in private subnets cannot reach the internet. Which configuration should be verified first?

A.Verify that the route table for the public subnets has a default route pointing to an internet gateway, and the private subnets' route table has a default route pointing to the NAT gateway

B.Verify that the VPC has a VPC endpoint for S3 configured

C.Verify that the network ACLs for the private subnets allow outbound traffic to 0.0.0.0/0

D.Verify that the security groups attached to the instances allow outbound HTTPS traffic

AnswerA

NAT gateway must be in a public subnet with a route to an internet gateway, and private subnets must route 0.0.0.0/0 to the NAT gateway.

Why this answer

For instances in private subnets to reach the internet via a NAT gateway, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway, and the NAT gateway must be placed in a public subnet whose route table has a default route pointing to an internet gateway. If either route is missing, outbound internet access will fail. Option B is incorrect because VPC endpoints are for accessing specific AWS services (e.g., S3), not general internet access.

Option C is incorrect because NACLs are stateless and by default allow all outbound traffic; although custom NACLs could block traffic, routing misconfiguration is a more common first issue. Option D is incorrect because security groups are stateful and outbound traffic is allowed by default; blocking outbound HTTPS would be an intentional change, not the first thing to verify.

Practice this question →

260

MCQmedium

A network engineer is configuring an AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The on-premises network advertises a prefix 10.0.0.0/8. One of the VPCs has a CIDR of 10.0.0.0/16. What will happen to traffic destined to 10.0.0.5 from another VPC attached to the Transit Gateway?

A.Traffic is routed to the VPC because of a more specific route

B.Traffic is dropped due to conflicting routes

C.Traffic is routed to the on-premises network because it is learned via Direct Connect

D.Traffic is load-balanced between the VPC and on-premises

AnswerA

Correct; Transit Gateway uses longest prefix match, and /16 is more specific than /8.

Why this answer

AWS Transit Gateway uses longest prefix match routing. The VPC's CIDR 10.0.0.0/16 is more specific than the on-premises prefix 10.0.0.0/8, so traffic destined to 10.0.0.5 will be routed to the VPC. Option B is incorrect; routes conflict only if they have the same prefix length, but here different lengths allow the longest prefix to win.

Option C is incorrect because the on-premises route is less specific and will not be used. Option D is incorrect because there is no load-balancing; the more specific route takes precedence.

Practice this question →

261

MCQhard

A company is deploying a latency-sensitive application across multiple AWS Regions. They want to use the AWS global network to route traffic to the nearest edge location for fast content delivery. Which service should they use?

A.AWS Global Accelerator

B.Amazon Route 53

C.AWS Direct Connect

D.Amazon CloudFront

AnswerA

Global Accelerator improves performance by routing traffic over the AWS backbone to the nearest edge.

Why this answer

AWS Global Accelerator uses the AWS global network to direct traffic to the nearest edge location via Anycast IP addresses, then routes it over the AWS backbone to the optimal regional endpoint. This minimizes latency and jitter for latency-sensitive applications by avoiding the public internet and providing static IP addresses for traffic management.

Exam trap

The ANS-C01 exam often tests the distinction between a CDN (CloudFront) and a global network accelerator (Global Accelerator), where candidates mistakenly choose CloudFront for latency-sensitive non-HTTP traffic or real-time applications that require static IP addresses and TCP/UDP optimization.

How to eliminate wrong answers

Option B (Amazon Route 53) is wrong because it is a DNS service that resolves domain names to IP addresses; it does not provide edge-based traffic acceleration or use the AWS global network for routing, and its latency-based routing is DNS-level, not real-time path optimization. Option C (AWS Direct Connect) is wrong because it is a dedicated network connection from on-premises to AWS, not a service for routing traffic to edge locations or accelerating content delivery across regions. Option D (Amazon CloudFront) is wrong because it is a content delivery network (CDN) optimized for caching static and dynamic content at edge locations, not for accelerating TCP/UDP traffic for latency-sensitive applications that require real-time routing over the AWS global network.

Practice this question →

262

Multi-Selectmedium

A company is setting up a site-to-site VPN connection between an on-premises network and AWS. The VPN uses two tunnels for high availability. The network engineer needs to ensure that if one tunnel goes down, traffic automatically fails over to the other tunnel. Which THREE steps should the engineer perform? (Choose THREE.)

Select 3 answers

A.Configure static routes pointing to the VPN connection.

B.Configure BGP on both VPN tunnels.

C.Use a single customer gateway device with multiple BGP sessions.

D.Configure two customer gateway devices on-premises, each with a separate BGP session.

E.Enable route propagation on the VPC route table for the virtual private gateway.

AnswersB, D, E

BGP provides automatic failover between tunnels.

Why this answer

BGP is the correct choice for automatic failover because it enables dynamic route advertisement and withdrawal over the VPN tunnels. When a tunnel fails, BGP withdraws the corresponding routes, causing the VPC route table to automatically use the remaining tunnel's routes. This eliminates the need for manual intervention or static route manipulation.

Exam trap

The ANS-C01 exam often tests the misconception that a single customer gateway device with multiple BGP sessions is sufficient for high availability, but the trap is that this only protects against tunnel failure, not device failure; the correct approach for full redundancy is to use two separate customer gateway devices, each with its own BGP session (Option D).

Practice this question →

263

MCQeasy

A company wants to enable DNS resolution for hybrid network using Route 53 Resolver. The on-premises DNS servers are reachable via Direct Connect. The company wants to forward queries for a custom domain (example.corp) from VPC to on-premises. Which resource should be created in the VPC?

A.A VPC endpoint for Route 53 Resolver service.

B.Route 53 Resolver rule that forwards example.corp to on-premises DNS servers.

C.Route 53 Resolver inbound endpoint.

D.Route 53 Resolver outbound endpoint and associate a resolver rule.

AnswerD

An outbound endpoint forwards DNS queries from VPC to on-premises, and a rule specifies the domain.

Why this answer

To forward DNS queries from a VPC to on-premises DNS servers, you need a Route 53 Resolver outbound endpoint, which initiates outbound DNS traffic from the VPC. You then associate a resolver rule that specifies the domain (example.corp) and the target on-premises DNS server IPs, enabling conditional forwarding via Direct Connect.

Exam trap

The ANS-C01 exam often tests the distinction between inbound and outbound endpoints; the trap here is confusing the direction of DNS traffic, leading candidates to select the inbound endpoint (Option C) when outbound forwarding is required.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint for Route 53 Resolver service is used to privately access Route 53 APIs, not to forward DNS queries to on-premises. Option B is wrong because a resolver rule alone is not a resource that can be created in a VPC; it must be associated with an outbound endpoint to function. Option C is wrong because a Route 53 Resolver inbound endpoint is used to receive DNS queries from on-premises into the VPC, not to forward queries outbound from the VPC to on-premises.

Practice this question →

264

MCQhard

A company is setting up AWS Direct Connect with a 1 Gbps dedicated connection. They want redundant connectivity with automatic failover. What is the most cost-effective way to achieve this?

A.Use a single connection with multiple VLANs.

B.Use a single connection with a VPN over the same connection for redundancy.

C.Provision a second Direct Connect connection at a different location and configure BGP.

D.Provision a single Direct Connect connection and use a VPN over the internet as backup.

AnswerC

A second Direct Connect connection at a different location with BGP provides true physical redundancy and automatic failover. This is the correct and most cost-effective choice among the options.

Why this answer

Achieving true redundancy with automatic failover for AWS Direct Connect requires physically diverse connections. A second Direct Connect connection at a different location, combined with BGP routing (e.g., using AS_PATH prepending or MED for traffic engineering), ensures that traffic automatically fails over if one connection goes down. While a VPN over the internet (option D) might seem cost-effective, it introduces variable latency, potential bandwidth constraints, and additional data transfer costs, making it less suitable for consistent performance and automatic failover in a dedicated connectivity context.

Therefore, provisioning a second Direct Connect connection is the most cost-effective approach that meets the requirements.

Exam trap

Candidates often assume that a VPN backup over the internet is the most cost-effective redundancy option, but the exam tests that for dedicated connections, physical diversity is required to maintain consistent performance and meet SLAs. A VPN over the same connection (option B) or multiple VLANs (option A) do not provide true physical redundancy.

How to eliminate wrong answers

Option A is wrong because a single connection with multiple VLANs does not provide physical redundancy; a single fiber cut or device failure would take down all VLANs and all traffic. Option B is wrong because using a VPN over the same Direct Connect connection does not add a physically diverse path; it still relies on the same underlying single connection, so it offers no failover if that connection fails. Option D is wrong because while a VPN over the internet provides a backup path, it introduces additional latency, potential bandwidth limitations, and ongoing VPN costs that are typically higher than the cost of a second Direct Connect connection at a different location, making it less cost-effective for a 1 Gbps dedicated connection scenario.

Practice this question →

265

MCQeasy

A company has a VPC with public and private subnets in two Availability Zones. The company hosts a web application on EC2 instances in the private subnets. The application needs to access an S3 bucket. What is the MOST cost-effective and secure way to provide this access?

A.Deploy a NAT Gateway in each public subnet and route traffic from private subnets through it.

B.Use AWS Transit Gateway to route traffic to S3 via a centralized VPN.

C.Attach an Internet Gateway to the VPC and assign public IPs to the EC2 instances.

D.Create a VPC Gateway Endpoint for S3 and attach it to the private subnet route tables.

AnswerD

Cost-effective and secure; no data transfer costs.

Why this answer

A VPC Gateway Endpoint for S3 provides private, secure connectivity to S3 without traversing the public internet, and it incurs no hourly or data processing charges, making it the most cost-effective and secure choice. Traffic stays within the AWS network, and the endpoint is attached to the private subnet route tables, allowing EC2 instances in those subnets to access S3 directly without needing a NAT Gateway or public IPs.

Exam trap

The trap here is that candidates often confuse VPC Gateway Endpoints with Interface Endpoints or assume a NAT Gateway is required for private subnet internet access, overlooking that S3 can be accessed privately and cost-effectively via a Gateway Endpoint without any NAT or internet gateway.

How to eliminate wrong answers

Option A is wrong because deploying a NAT Gateway in each public subnet incurs hourly charges and data processing costs, and it routes traffic through the internet, which is less secure and more expensive than a VPC Gateway Endpoint. Option B is wrong because AWS Transit Gateway is designed for connecting multiple VPCs or on-premises networks, not for providing direct S3 access; using a centralized VPN adds unnecessary complexity, latency, and cost. Option C is wrong because attaching an Internet Gateway and assigning public IPs to EC2 instances exposes them to the public internet, violating security best practices and incurring additional costs for data transfer over the internet.

Practice this question →

266

MCQeasy

A company needs to securely connect multiple VPCs across different AWS Regions using AWS backbone network infrastructure without traversing the public internet. The solution must be managed centrally and support transitive routing between VPCs. Which service should the company use?

A.VPC peering connections in a full mesh.

B.AWS PrivateLink and VPC Endpoints.

C.AWS Transit Gateway with inter-region peering.

D.AWS ClassicLink.

AnswerC

Transit Gateway supports transitive routing across VPCs and regions using inter-region peering.

Why this answer

AWS Transit Gateway with inter-region peering allows you to connect VPCs across different AWS Regions using the AWS global backbone, avoiding the public internet. It provides a central hub for managing connectivity and supports transitive routing between all attached VPCs, which is not possible with VPC peering alone. This makes it the correct choice for a centrally managed, transitive, cross-region solution.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering can be used in a full mesh to achieve transitive routing, but candidates must remember that VPC peering is non-transitive and requires explicit routing for each pair.

How to eliminate wrong answers

Option A is wrong because VPC peering connections in a full mesh do not support transitive routing; each peering connection is a one-to-one relationship, and traffic cannot hop from one VPC to another through an intermediate VPC. Option B is wrong because AWS PrivateLink and VPC Endpoints are designed for private access to specific services (e.g., SaaS or AWS services) from within a VPC, not for connecting multiple VPCs with transitive routing across regions. Option D is wrong because AWS ClassicLink is a legacy feature for linking EC2-Classic instances to a VPC, and it does not support inter-region connectivity, transitive routing, or central management.

Practice this question →

267

Multi-Selecthard

Which THREE of the following are benefits of using AWS Transit Gateway over VPC peering for inter-VPC connectivity? (Choose three.)

Select 3 answers

A.Transitive routing between all attached VPCs

B.Lower latency than VPC peering

C.Support for connecting to on-premises networks via Direct Connect and VPN

D.No additional cost compared to VPC peering

E.Centralized management of network connections

AnswersA, C, E

Transit Gateway supports transitive routing; VPC peering does not.

Why this answer

AWS Transit Gateway enables transitive routing, meaning that traffic can flow between any attached VPCs without needing a full mesh of VPC peering connections. With VPC peering, each pair of VPCs requires a separate peering connection, and transitive routing is not supported — traffic cannot hop from one peered VPC to another. Transit Gateway acts as a hub-and-spoke router, simplifying connectivity and scaling to hundreds of VPCs.

Exam trap

The ANS-C01 exam often tests the misconception that Transit Gateway always reduces latency compared to VPC peering, but in reality, VPC peering can have slightly lower latency because it creates a direct one-to-one connection without an intermediate routing hop.

Practice this question →

268

MCQhard

A financial services company is designing a multi-region architecture for disaster recovery. They have a primary VPC in us-east-1 and a standby VPC in us-west-2. Each VPC has its own CIDR block (10.0.0.0/16 and 10.1.0.0/16). They want to use an inter-region VPC peering connection for replication traffic. Which of the following is a required step to establish this peering connection?

A.Ensure the VPC CIDR blocks do not overlap.

B.Create a VPN attachment between the two VPCs using AWS Site-to-Site VPN.

C.The owner of each VPC must accept the peering connection request.

D.Create two separate peering connections, one for each direction of traffic.

AnswerC

Both sides must accept the peering request for it to be active.

Why this answer

Inter-region VPC peering connections require both VPC owners to accept the peering request. In AWS, a VPC peering connection is a one-to-one relationship between two VPCs, and the request must be accepted by the owner of the accepter VPC (in this case, the standby VPC in us-west-2) after the requester VPC (us-east-1) initiates it. This acceptance is a mandatory step for the peering connection to become active, regardless of whether the VPCs are in the same or different regions.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering is automatically bidirectional or that both owners must initiate separate requests, but in reality, a single request and acceptance creates a bidirectional link, and the trap here is that candidates may think overlapping CIDRs or VPN attachments are required for inter-region peering.

How to eliminate wrong answers

Option A is wrong because non-overlapping CIDR blocks are not a requirement for inter-region VPC peering; they are only required for intra-region peering to avoid routing conflicts, but inter-region peering allows overlapping CIDRs as long as routes are managed carefully (though overlapping CIDRs can cause routing issues in practice, it is not a blocking requirement). Option B is wrong because AWS Site-to-Site VPN is a separate service used for connecting on-premises networks to VPCs or for creating VPN attachments between VPCs via Transit Gateway, but it is not required for VPC peering; VPC peering uses the AWS global network backbone directly without VPN tunnels. Option D is wrong because a single VPC peering connection is bidirectional by design; traffic can flow in both directions once the peering is established and routes are added to both VPC route tables, so two separate connections are unnecessary.

Practice this question →

269

MCQmedium

A company has deployed a VPC with a public subnet and a private subnet in each of two Availability Zones. They have an Application Load Balancer (ALB) in the public subnets and EC2 instances in the private subnets. The EC2 instances need to access an external API over HTTPS. What is the MOST secure way to provide this access?

A.Deploy a NAT Gateway in each public subnet and add a default route in the private subnet route tables pointing to the NAT Gateway.

B.Create a VPC endpoint for the external API service.

C.Assign public IP addresses to the EC2 instances and allow outbound traffic in the security group.

D.Set up a VPN connection to an on-premises network that has internet access.

AnswerA

NAT Gateway provides outbound-only internet access securely.

Why this answer

A NAT Gateway in each public subnet provides a managed, highly available path for EC2 instances in private subnets to initiate outbound HTTPS connections to the internet while preventing inbound connections from reaching them. Adding a default route (0.0.0.0/0) in the private subnet route tables pointing to the NAT Gateway ensures traffic destined for the external API is forwarded through the NAT Gateway, which performs source network address translation (SNAT) using its Elastic IP. This is the most secure method because it avoids exposing the EC2 instances directly to the internet and leverages AWS-managed infrastructure for scalability and fault tolerance.

Exam trap

The trap here is that candidates often confuse VPC endpoints (PrivateLink) with NAT Gateways, assuming a VPC endpoint can be used for any external API, but VPC endpoints only work for services that explicitly support AWS PrivateLink or are AWS services, not arbitrary public HTTPS APIs.

How to eliminate wrong answers

Option B is wrong because a VPC endpoint (typically an interface or Gateway Load Balancer endpoint) is used for private connectivity to AWS services (e.g., S3, DynamoDB) or supported third-party services via AWS PrivateLink, not for accessing an arbitrary external API over the public internet; the external API would need to be hosted behind a Network Load Balancer with a VPC endpoint service, which is not stated. Option C is wrong because assigning public IP addresses to EC2 instances and allowing outbound traffic in the security group exposes the instances to the internet, increasing the attack surface and violating the principle of least privilege; it also requires managing public IPs and security group rules for outbound-only access, which is less secure than using a NAT Gateway. Option D is wrong because setting up a VPN connection to an on-premises network that has internet access adds unnecessary complexity, latency, and cost; it does not directly solve the requirement for EC2 instances in a VPC to access an external API over HTTPS, and the on-premises network becomes a single point of failure or bottleneck.

Practice this question →

270

Multi-Selectmedium

Which TWO of the following are valid methods to connect multiple VPCs together in a hub-and-spoke topology while maintaining centralized control? (Choose two.)

Select 2 answers

A.Create a VPN connection between each VPC and a central VPN appliance.

B.Establish VPC peering connections in a full mesh and manage routes centrally.

C.Use Direct Connect to connect VPCs.

D.Use an AWS Transit Gateway with a central VPC as the hub.

E.Use VPC Gateway Endpoints to connect VPCs.

AnswersB, D

Possible but less scalable than Transit Gateway.

Why this answer

VPC peering connections can be arranged in a full mesh, and by centrally managing route tables (e.g., using a centralized route management tool or a central VPC with route propagation), you can enforce a hub-and-spoke routing pattern. Option D is correct because AWS Transit Gateway inherently supports hub-and-spoke topologies by attaching multiple VPCs to a single gateway, which acts as the hub, and allows centralized control over routing and security policies.

Exam trap

The trap here is that candidates often confuse VPC peering as inherently non-hub-and-spoke, but the question allows for a full mesh of peering connections with centralized route management, which technically satisfies the requirement, while Direct Connect and Gateway Endpoints are frequently misapplied as VPC-to-VPC connectivity solutions.

Practice this question →

271

Multi-Selectmedium

A company is designing a VPC with a public subnet and a private subnet. The private subnet hosts an RDS database, and the public subnet hosts a web server. The web server needs to access the database. Which TWO of the following are required to allow the web server to connect to the database?

Select 2 answers

A.An inbound rule in the database's security group that allows traffic from the web server's private IP address.

B.An inbound rule in the database's security group that references the web server's security group.

C.An internet gateway attached to the VPC.

D.A route table associated with the private subnet that includes a route to the public subnet's CIDR block via the local route.

E.A NAT gateway in the public subnet.

AnswersB, D

Allows traffic from any instance with that SG.

Why this answer

Security group rules can reference other security groups as a source, allowing traffic from any instance associated with the referenced security group (the web server's security group) without needing to specify individual IP addresses. This is the recommended AWS best practice for inter-instance communication within a VPC, as it dynamically adapts to changes in the web server's IP or scaling events.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT gateway or internet gateway is required for any cross-subnet communication, but the trap here is that traffic between subnets within the same VPC uses the local route and does not require any gateway.

Practice this question →

272

MCQeasy

A company has deployed an application in a VPC with public and private subnets across two Availability Zones. The application uses an Application Load Balancer (ALB) in the public subnets to distribute traffic to EC2 instances in the private subnets. The company wants to use AWS WAF to protect against SQL injection attacks. Where should the AWS WAF web ACL be associated?

A.The Application Load Balancer.

B.Amazon Route 53 hosted zone.

C.The security group of the EC2 instances.

D.The VPC internet gateway.

AnswerA

The Application Load Balancer. [CORRECT]

Why this answer

AWS WAF is a web application firewall that protects web resources from common exploits like SQL injection. It integrates directly with Application Load Balancers (ALBs) by allowing you to associate a web ACL with the ALB, which inspects HTTP/HTTPS traffic before it reaches the backend EC2 instances. This is the only supported integration point among the options for protecting application-layer traffic in this architecture.

Exam trap

The trap here is that candidates often confuse security groups (layer 4 filtering) with web application firewalls (layer 7 inspection), leading them to incorrectly select the security group option, even though security groups cannot inspect application-layer payloads like SQL injection strings.

How to eliminate wrong answers

Option B is wrong because Amazon Route 53 is a DNS service that resolves domain names to IP addresses; it does not process HTTP/HTTPS traffic and cannot inspect payloads for SQL injection attacks. Option C is wrong because security groups are stateful firewalls that filter traffic at the network and transport layer (IP addresses, ports, protocols); they cannot inspect application-layer content like SQL injection patterns. Option D is wrong because an internet gateway is a horizontally scaled, redundant VPC component that allows communication between the VPC and the internet at the network layer; it has no capability to perform deep packet inspection or apply WAF rules.

Practice this question →

273

Multi-Selecteasy

Which TWO of the following are valid methods to provide outbound internet access to instances in a private subnet?

Select 2 answers

A.Use a VPC endpoint for internet access

B.Attach an internet gateway directly to the private subnet

C.Deploy a NAT instance in a public subnet and configure routing

D.Deploy a NAT gateway in a public subnet and add a route to it from the private subnet

E.Use a VPN connection to the internet

AnswersC, D

NAT instance is a legacy but valid method.

Why this answer

The correct answers are C and D. A NAT instance (C) or a NAT gateway (D) deployed in a public subnet with a default route pointing to them from the private subnet provides outbound internet access while keeping instances private. Option A is incorrect because VPC endpoints only provide private access to AWS services, not general internet.

Option B is incorrect because an internet gateway is attached to the VPC, not directly to a subnet, and instances in private subnets cannot use it without a NAT device. Option E is incorrect because a VPN connection is for private connectivity to on-premises networks, not internet access.

Practice this question →

274

MCQhard

A company has a VPC with CIDR 10.0.0.0/16. They have two Availability Zones (us-east-1a and us-east-1b). In each AZ, there is a public subnet (10.0.1.0/24 and 10.0.2.0/24) and a private subnet (10.0.3.0/24 and 10.0.4.0/24). A NAT Gateway is deployed in the public subnet of us-east-1a. The private route tables for both private subnets have a default route pointing to the NAT Gateway. An application team has deployed EC2 instances in the private subnets. They report that instances in us-east-1b cannot access the internet, while instances in us-east-1a can. The NAT Gateway is healthy and has an Elastic IP attached. The route tables for the public subnets have a default route to the Internet Gateway. What is the most likely cause of the issue?

A.The NAT Gateway is deployed in a private subnet

B.The route table for the public subnet in us-east-1b does not have a default route to the Internet Gateway

C.The NAT Gateway has reached the maximum number of concurrent connections

D.The NAT Gateway is in a different Availability Zone than the private subnet instances, causing cross-AZ data transfer charges

AnswerC

Correct. NAT Gateway connection limits can prevent new connections, causing internet access failures for instances that have not already established a session.

Why this answer

The most likely cause is that the NAT Gateway has reached its maximum number of concurrent connections. When connection limits are exceeded, new outbound connections from instances in any private subnet may fail, leading to internet access issues. This explains why instances in us-east-1a (which may have established connections earlier) can still access the internet, while instances in us-east-1b cannot.

Option A is incorrect because the NAT Gateway is correctly placed in a public subnet. Option B is incorrect because the route table of the public subnet in us-east-1b does not affect traffic from private instances; they route directly to the NAT Gateway in us-east-1a. Option D is incorrect because cross-AZ data transfer charges are a cost concern and do not block network traffic.

Therefore, the most plausible technical cause is option C.

Exam trap

Candidates often assume a NAT Gateway in one AZ can serve private instances in another AZ without any issues, but cross-AZ data transfer charges apply, which can be a concern for cost, but not connectivity.

Practice this question →

275

MCQmedium

A company is using AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises data center to a VPC. The VPC has a virtual private gateway (VGW) attached. The company has recently added a second VPC and wants to use the same Direct Connect connection to access both VPCs. The network engineer proposes using a Direct Connect gateway (DXGW) with two private VIFs, one for each VPC. However, the engineer wants to minimize complexity and cost. Which configuration should the engineer use to allow both VPCs to use the same Direct Connect connection?

A.Create a Direct Connect gateway and associate it with the private VIF. Then associate both VPCs' virtual private gateways with the Direct Connect gateway.

B.Create a private VIF for each VPC on the same Direct Connect connection.

C.Create a public virtual interface on the Direct Connect connection and attach both VPCs to it.

D.Create a single private VIF and attach both VPCs directly to it.

AnswerA

DXGW allows one VIF to reach multiple VPCs.

Why this answer

A Direct Connect gateway (DXGW) can be associated with a single private virtual interface (VIF) and then attached to multiple virtual private gateways (VGWs) in different VPCs, allowing both VPCs to use the same Direct Connect connection with minimal complexity and cost. Option B is incorrect because it requires creating two private VIFs, increasing cost and complexity. Option C is incorrect because a public VIF is used for accessing public AWS services, not for connecting to VPCs.

Option D is incorrect because a single private VIF cannot be directly attached to multiple VPCs; a DXGW is needed to aggregate the connections.

Practice this question →

276

MCQeasy

A company is deploying a VPC with public and private subnets in two Availability Zones. The workloads in the private subnets need to access the internet for software updates. What is the MOST secure way to provide this internet access?

A.Deploy a NAT gateway in a public subnet and update the private subnets' route table to point default traffic to the NAT gateway.

B.Set up a VPN connection to an on-premises network with internet access.

C.Use a transit gateway with a VPC attachment and route internet traffic through a centralized inspection VPC.

D.Attach an internet gateway to the VPC and route the private subnets' traffic to it.

AnswerA

NAT gateway allows outbound internet access while blocking unsolicited inbound traffic.

Why this answer

A NAT gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound traffic from the internet. This is the most secure and AWS-recommended method because it uses Source Network Address Translation (SNAT) to mask private IPs behind the NAT gateway's Elastic IP, and it requires only a route table update in the private subnets to direct default traffic (0.0.0.0/0) to the NAT gateway.

Exam trap

The ANS-C01 exam often tests the misconception that an internet gateway can be used directly for private subnets, but the trap here is that private subnets must never have a default route pointing to an internet gateway because that would make instances publicly routable; instead, a NAT gateway or NAT instance is required to provide outbound-only internet access.

How to eliminate wrong answers

Option B is wrong because a VPN connection to an on-premises network with internet access introduces unnecessary complexity, latency, and a single point of failure; it also violates the principle of least privilege by routing all internet-bound traffic through a potentially less secure on-premises environment, and it does not leverage AWS-native services for direct internet access. Option C is wrong because using a transit gateway with a centralized inspection VPC is over-engineered for simple internet access; it adds cost, complexity, and potential bottlenecks, and is typically used for advanced traffic inspection or inter-VPC routing, not for basic outbound internet connectivity from private subnets. Option D is wrong because attaching an internet gateway directly to the VPC and routing private subnet traffic to it would expose private instances to the internet without NAT, making them directly reachable from the internet if they have public IPs, which defeats the purpose of private subnets and creates a severe security risk.

Practice this question →

277

MCQmedium

A company is using AWS Direct Connect with a public virtual interface to access Amazon S3. The on-premises network has a firewall that only allows traffic to specific IP prefixes. What is the best practice to ensure connectivity while maintaining security?

A.Allow all traffic to the AWS region's IP range.

B.Set up a Site-to-Site VPN tunnel over Direct Connect.

C.Use a private virtual interface and connect through a VPC endpoint.

D.Use the S3 IP prefix list from AWS to create firewall rules.

AnswerD

Prefix lists provide specific S3 IP addresses.

Why this answer

AWS publishes managed prefix lists for each service, including Amazon S3, which contain the specific IP prefixes used by S3 in each region. By using these prefix lists in firewall rules, you can allow only the necessary S3 traffic while maintaining strict security, rather than permitting the entire region's IP range. This approach aligns with the principle of least privilege and ensures connectivity over the public VIF without exposing on-premises networks to unnecessary traffic.

Exam trap

The ANS-C01 exam often tests the misconception that a private VIF or VPN is required for secure access to AWS services, when in fact a public VIF with service-specific prefix lists provides a secure and simpler solution for accessing public services like S3.

How to eliminate wrong answers

Option A is wrong because allowing all traffic to the AWS region's IP range is overly permissive and violates security best practices by permitting traffic to services other than S3, increasing the attack surface. Option B is wrong because setting up a Site-to-Site VPN tunnel over Direct Connect is unnecessary for accessing S3 via a public VIF; it adds complexity and cost without improving security, as S3 traffic is already encrypted via HTTPS and the public VIF provides direct connectivity. Option C is wrong because a private virtual interface requires a VPC endpoint (e.g., Gateway Endpoint for S3) and is designed for private connectivity within a VPC, not for direct on-premises access to S3 over a public VIF; it would require additional routing and VPC configuration, making it less straightforward for this use case.

Practice this question →

278

Multi-Selectmedium

A company is designing a multi-region active-active application using Application Load Balancers (ALBs) and AWS Global Accelerator. Which TWO configurations are required to route traffic to the correct regional endpoint based on the client's location?

Select 2 answers

A.Define endpoint groups in Global Accelerator for each region.

B.Enable AWS Shield Advanced on the ALBs.

C.Create an AWS Global Accelerator accelerator with endpoints in both regions.

D.Configure cross-region load balancing in the ALB target groups.

E.Configure Amazon Route 53 latency-based routing to the ALBs.

AnswersA, C

Endpoint groups specify the regional endpoints and traffic distribution.

Why this answer

Endpoint groups in AWS Global Accelerator define the regional endpoints (such as ALBs) and allow you to control traffic routing based on the client's source location. Global Accelerator uses the Anycast IP addresses and the AWS global network to direct traffic to the nearest endpoint group, providing performance-based routing without relying on DNS.

Exam trap

The trap here is that candidates often confuse DNS-based routing (Route 53 latency routing) with Global Accelerator's Anycast-based routing, assuming both achieve the same result, but Global Accelerator provides faster failover and more consistent performance by avoiding DNS caching and using the AWS backbone.

Practice this question →

279

MCQhard

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. The ALB is internet-facing and uses TLS termination. The application requires that client IP addresses be preserved in the backend logs. The backend instances are in private subnets behind the ALB. Which configuration will ensure client IP addresses are preserved without additional overhead?

A.Attach a VPC Endpoint to the ALB to capture client IP

B.Enable Proxy Protocol v2 on the target group

C.Replace the ALB with a Network Load Balancer (NLB)

D.Configure the ALB to pass the X-Forwarded-For header and ensure backend logs parse it

AnswerD

Correct; ALB automatically adds X-Forwarded-For header, and backend can log that to capture client IP.

Why this answer

The ALB automatically adds the X-Forwarded-For header to HTTP requests, containing the original client IP address. Since the backend instances are in private subnets and receive traffic from the ALB's private IPs, parsing this header in the backend logs is the standard, zero-overhead method to preserve client IPs for HTTP/HTTPS traffic with TLS termination.

Exam trap

The trap here is that candidates confuse Proxy Protocol v2 (an NLB feature) with the ALB's X-Forwarded-For mechanism, or assume that preserving client IPs requires a complex solution like a VPC Endpoint or replacing the load balancer, when the ALB already handles it natively for HTTP traffic.

How to eliminate wrong answers

Option A is wrong because a VPC Endpoint is used for private connectivity to AWS services (e.g., S3, DynamoDB) and does not capture or forward client IPs to an ALB. Option B is wrong because Proxy Protocol v2 is a feature of Network Load Balancers (NLBs) and Network Load Balancer target groups, not Application Load Balancers; enabling it on an ALB target group is unsupported and would cause configuration errors. Option C is wrong because replacing the ALB with an NLB would require additional overhead to handle TLS termination (NLBs do not terminate TLS natively) and would lose HTTP-specific features like path-based routing and the X-Forwarded-For header, which is the simplest solution for preserving client IPs in an HTTP application.

Practice this question →

280

MCQhard

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC. The ALB is in public subnets, and the web servers are in private subnets. The ALB is configured with a target group pointing to the web servers. Users report intermittent 503 errors. The web servers are healthy according to the target group health checks. What is the most likely cause?

A.The ALB subnets do not have a route to an internet gateway

B.The target group health check interval is too long

C.The ALB is configured as internal instead of internet-facing

D.Cross-zone load balancing is disabled

AnswerA

Without a route to an internet gateway, the ALB cannot respond to client requests, causing 503 errors.

Why this answer

An internet-facing ALB must be deployed in public subnets that have a route to an internet gateway. Since the web servers are healthy but users get intermittent 503 errors, the issue is likely that the ALB's subnets lack a route to an internet gateway, preventing the ALB from sending responses to clients. Option B is wrong because a long health check interval would not cause 503 errors if the targets are healthy.

Option C is wrong because the ALB is described as being in public subnets and should be internet-facing; if it were internal, it would not receive internet traffic. Option D is wrong because cross-zone load balancing being disabled affects traffic distribution but does not cause intermittent 503 errors when targets are healthy.

Practice this question →

281

Multi-Selectmedium

A network engineer is troubleshooting a connectivity issue between two VPCs (VPC-A and VPC-B) that are connected via a VPC peering connection. The engineer has verified that the route tables in both VPCs have the appropriate routes. However, instances in VPC-A cannot ping instances in VPC-B. Which TWO actions should the engineer take to resolve this issue? (Choose two.)

Select 2 answers

A.Add a route in VPC-A's route table pointing to the VPC peering connection for the CIDR of VPC-B.

B.Enable DNS resolution for the VPC peering connection.

C.Verify that the network ACLs in VPC-B allow inbound ICMP traffic from VPC-A.

D.Verify that the security groups of the instances in VPC-B allow inbound ICMP traffic from the CIDR of VPC-A.

E.Configure a transit gateway to route traffic between the two VPCs.

AnswersC, D

Network ACLs are stateless and must allow both inbound and outbound traffic; if ICMP is denied, pings will fail.

Why this answer

Network ACLs are stateless firewalls that control inbound and outbound traffic at the subnet level. Even if the route tables are correctly configured, a network ACL in VPC-B that denies inbound ICMP traffic from VPC-A's CIDR will block ping requests. Option D is correct because security groups are stateful and must explicitly allow inbound ICMP traffic from VPC-A's CIDR; without this rule, the instances in VPC-B will drop the ping requests.

Exam trap

AWS often tests the distinction between stateless network ACLs and stateful security groups, and candidates mistakenly assume that correct route tables alone guarantee connectivity, overlooking the need to verify both firewall layers for the specific protocol (ICMP).

Practice this question →

282

MCQhard

A company is using CloudFormation to deploy a VPC. The private subnet route table has a route to a NAT gateway. However, instances in the private subnet cannot access the internet. The NAT gateway is in a public subnet and has an attached Elastic IP. What is the most likely issue?

A.The public subnet does not have a route to the internet gateway.

B.The private subnet route table does not have a route to the NAT gateway.

C.The NAT gateway is not in the same subnet as the private instances.

D.The NAT gateway's security group is blocking traffic from the private subnet.

AnswerD

NAT gateway security groups can block traffic.

Why this answer

The NAT gateway has a security group that by default denies all inbound traffic. For instances in the private subnet to send traffic to the internet, the NAT gateway's security group must allow inbound traffic from the private subnet's CIDR (or from the private subnet's network ACLs) and allow outbound traffic to the internet. Option D is correct because this is the most likely issue: the security group is blocking traffic.

Option A is incorrect because the public subnet route to the IGW is presumptively configured correctly for the NAT gateway to reach the internet. Option B is incorrect because the route to the NAT gateway is present in the private route table. Option C is incorrect because the NAT gateway does not need to be in the same subnet as the private instances; it must be in a public subnet.

Practice this question →

283

Multi-Selecthard

Which TWO of the following are required to establish a BGP session over a Direct Connect private virtual interface? (Choose TWO.)

Select 2 answers

A.A VLAN ID

B.A public IP address for the BGP peer

C.A Direct Connect gateway

D.BGP session with a customer router and AWS router

E.A VPN connection to the VPC

AnswersA, D

Each virtual interface is associated with a VLAN.

Why this answer

A VLAN ID is required because a Direct Connect private virtual interface operates over a single 802.1Q VLAN trunk. The VLAN ID uniquely identifies the virtual interface on the Direct Connect connection, allowing multiple virtual interfaces to share the same physical link. Without a VLAN ID, the Layer 2 encapsulation cannot be established, and the BGP session cannot form.

Exam trap

The ANS-C01 exam often tests the misconception that a Direct Connect gateway is mandatory for any Direct Connect setup, but it is only needed when connecting to multiple VPCs or using a transit gateway; a single VPC can use a virtual private gateway directly without a Direct Connect gateway.

Practice this question →

284

MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to initiate outbound connections to the internet. The company has a NAT gateway in the public subnet. The NAT gateway has an Elastic IP. The private subnet route table has a default route pointing to the NAT gateway. However, the EC2 instance cannot reach the internet. What is the most likely cause?

A.The security group of the EC2 instance blocks outbound traffic.

B.The route table in the public subnet does not have a default route to the internet gateway.

C.The network ACL of the private subnet blocks inbound traffic from the NAT gateway.

D.The NAT gateway's Elastic IP is not allowed by the destination's firewall.

AnswerD

Destination may block the public IP.

Why this answer

The NAT gateway's Elastic IP is a public IP address that the destination server sees as the source of the outbound traffic. If the destination's firewall (e.g., a security appliance or an internet-based service) explicitly blocks traffic from that Elastic IP, the EC2 instance will be unable to reach the internet, even though the VPC routing and NAT configuration are correct. This is a common scenario when the destination uses IP-based allowlists or blacklists.

Exam trap

The ANS-C01 exam often tests the misconception that NAT gateway or internet gateway configuration is the sole cause of connectivity failures, while in reality, external firewalls or destination-side IP filtering can independently block traffic even when all AWS-side networking is correctly configured.

How to eliminate wrong answers

Option A is wrong because security groups are stateful; if the EC2 instance initiates outbound traffic, the security group automatically allows the return traffic, and by default, security groups allow all outbound traffic unless explicitly modified. Option B is wrong because the public subnet's route table does not need a default route to the internet gateway for the private instance's outbound traffic; the NAT gateway in the public subnet handles the translation, and the public subnet's route table only affects traffic originating from the public subnet itself. Option C is wrong because network ACLs are stateless and must allow both inbound and outbound traffic separately; however, the private subnet's network ACL would need to allow outbound traffic to the NAT gateway (and the corresponding ephemeral ports for return traffic), not inbound from the NAT gateway, and the question states the instance cannot reach the internet, implying the outbound direction is blocked, not inbound.

Practice this question →

285

MCQhard

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network uses BGP to advertise routes to the VPC. The company wants to extend this connectivity to a second VPC in the same region without creating additional Direct Connect connections. Which solution should be used?

A.Create a second Direct Connect private VIF for the second VPC.

B.Set up a Site-to-Site VPN from the on-premises network to the second VPC.

C.Create a VPC peering connection between the two VPCs.

D.Use a transit gateway and attach both VPCs and the Direct Connect private VIF.

AnswerD

Transit gateway allows multiple VPCs to share Direct Connect.

Why this answer

A transit gateway allows you to centrally connect multiple VPCs and on-premises networks via a single Direct Connect private virtual interface. By attaching both VPCs and the Direct Connect private VIF to the transit gateway, the on-premises network can reach both VPCs without needing additional Direct Connect connections. This solution scales efficiently and supports transitive routing between all attached networks.

Exam trap

The ANS-C01 exam often tests the misconception that a single Direct Connect private VIF can be directly associated with multiple VPCs, but in reality, a private VIF can only be associated with one VPC or one transit gateway, making the transit gateway the correct scaling solution.

How to eliminate wrong answers

Option A is wrong because creating a second Direct Connect private VIF would require an additional virtual interface on the same Direct Connect connection, but the question explicitly states the company wants to avoid creating additional Direct Connect connections; more importantly, a single private VIF can only be associated with one VPC (or one transit gateway) at a time, so this does not solve the need to extend connectivity to a second VPC without extra connections. Option B is wrong because setting up a Site-to-Site VPN introduces a separate, internet-based connection that bypasses the existing Direct Connect, adding latency, complexity, and potential security concerns; it does not leverage the existing Direct Connect private VIF. Option C is wrong because a VPC peering connection only enables direct communication between the two VPCs, but it does not extend the on-premises network’s reachability to the second VPC; on-premises routes are not automatically propagated across a VPC peering connection, so the on-premises network would still be unable to reach the second VPC without additional routing configuration and potential use of a transit gateway or VPN.

Practice this question →

286

MCQeasy

A company is setting up an AWS Client VPN endpoint for remote access. Users report they can connect to the VPN but cannot access resources in the VPC. The VPN endpoint is associated with a subnet that has a route table with a route to an internet gateway. The security group for the VPN endpoint allows all traffic. What could be the issue?

A.The route table associated with the VPN subnet does not have a route to the VPC CIDR

B.The authorization rules for the VPN endpoint do not include the VPC CIDR

C.The security group for the VPN endpoint does not allow outbound traffic

D.The client CIDR range overlaps with the VPC CIDR

AnswerA

A route to the VPC CIDR via the VPN endpoint's network interface is required.

Why this answer

The VPN endpoint is associated with a subnet, and that subnet's route table must include a route to the VPC CIDR to allow traffic from VPN clients to reach VPC resources. Without this route, packets from VPN clients are dropped because the subnet does not know how to forward them to the VPC. Option A is correct.

Option B is incorrect because authorization rules control user access to specific destinations, but they do not affect routing; if the route is missing, traffic never reaches the VPC regardless of authorization. Option C is incorrect because the security group allows all traffic, so it is not blocking access. Option D is incorrect because while client CIDR overlap could cause issues, users can connect to the VPN, indicating no overlap; the primary issue is the missing route.

Practice this question →

287

MCQmedium

A company has a VPC with a CIDR of 172.16.0.0/16. The VPC has two subnets: subnet A (172.16.1.0/24) and subnet B (172.16.2.0/24). The company launches an EC2 instance in subnet A with a private IP of 172.16.1.10 and a public IP. The instance's security group allows inbound SSH from 0.0.0.0/0. The subnet A's route table has a route to an internet gateway (IGW) for 0.0.0.0/0. The network engineer can SSH into the instance from the internet. The company then attaches a second network interface (eth1) to the instance with an IP from subnet B (172.16.2.20). The engineer wants to use this interface for additional management traffic. After attaching, the engineer can no longer SSH into the instance via the original public IP. What is the MOST likely cause?

A.The operating system's routing table now uses eth1 as the default gateway, causing asymmetric routing.

B.The route table for subnet B does not have a route to the IGW.

C.The security group for eth1 blocks inbound SSH.

D.The internet gateway is not attached to subnet B.

AnswerA

Asymmetric routing can cause connection issues.

Why this answer

When a second ENI (eth1) is attached to an EC2 instance, the operating system may reassign the default gateway route to the new interface, especially if the new interface receives a default route via DHCP. This causes traffic from the instance to egress via eth1 instead of eth0, while inbound traffic still arrives via the original public IP on eth0. This asymmetric routing breaks the SSH session because the response packets are sent out through eth1, which is in a different subnet and does not have the same public IP, so they are dropped.

Option A correctly identifies this issue. Option D is incorrect because the IGW is attached to the VPC, not to individual subnets. Options B and C are not the most likely cause given the scenario.

Practice this question →

288

MCQmedium

A company needs to connect its on-premises data center to AWS using AWS Direct Connect. The company has two redundant connections and wants to use BGP as the routing protocol. Which BGP attribute should be manipulated to influence outbound traffic from AWS to the on-premises network?

A.Set the Local Preference attribute on routes received from AWS.

B.Prepend AS_PATH on routes advertised to AWS.

C.Set the MED attribute on routes advertised to AWS.

D.Apply a BGP community tag to routes received from AWS.

AnswerB

AS_PATH prepend makes a path less preferred for outbound traffic from AWS.

Why this answer

To influence outbound traffic from AWS to the on-premises network, you must make the on-premises routes less attractive to AWS. Prepend AS_PATH on routes advertised to AWS increases the AS path length, making those routes less preferred by AWS's BGP best-path selection, thus steering traffic away from that Direct Connect virtual interface.

Exam trap

The trap here is confusing inbound vs. outbound traffic manipulation: candidates often pick Local Preference (Option A) because it is a common attribute for influencing path selection, but it only affects traffic entering the local AS, not traffic leaving AWS.

How to eliminate wrong answers

Option A is wrong because Local Preference is an inbound BGP attribute used to influence traffic entering an AS, not outbound traffic from AWS; it is set on routes received from a peer to affect local routing decisions. Option C is wrong because MED (Multi-Exit Discriminator) is an outbound attribute used to influence inbound traffic to an AS, not outbound traffic from AWS; it is advertised to a neighbor to suggest a preferred entry point. Option D is wrong because BGP community tags are used for tagging and policy enforcement (e.g., route filtering or preference marking) but do not directly influence BGP best-path selection for outbound traffic; they require additional configuration on the receiving side to have any effect.

Practice this question →

289

MCQeasy

A network engineer created the CloudFormation stack shown. After creation, an EC2 instance launched in PublicSubnet does not have a public IP address. What is the most likely reason?

A.The VPC does not have an Internet Gateway attached

B.The subnet does not have an Internet Gateway attached

C.The subnet's route table does not have a route to a NAT Gateway

D.The instance type does not support public IP addresses

AnswerA

Without an Internet Gateway, instances cannot be assigned public IPs or reach the internet.

Why this answer

An EC2 instance in a public subnet requires an Internet Gateway (IGW) attached to the VPC to receive a public IP address. Without an IGW, the instance cannot be assigned a public IP or communicate with the internet, even if the subnet is configured to auto-assign public IPs. The CloudFormation stack likely omitted the IGW resource or its attachment to the VPC, leaving the VPC isolated.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT Gateway is required for public IP assignment, but the correct requirement is an Internet Gateway attached to the VPC with a route in the subnet's route table.

How to eliminate wrong answers

Option B is wrong because an Internet Gateway is attached to the VPC, not to a subnet; subnets are associated with route tables that direct traffic to the IGW, but the IGW itself is a VPC-level resource. Option C is wrong because a NAT Gateway is used for private subnets to initiate outbound internet traffic, not for public subnets; a public subnet requires a route to an IGW (0.0.0.0/0 -> IGW) for public IP assignment and inbound internet access. Option D is wrong because all EC2 instance types support public IP addresses when launched in a subnet with the appropriate settings and an IGW attached; the instance type does not restrict public IP assignment.

Practice this question →

290

MCQhard

A global e-commerce company uses AWS CloudFront to distribute content. They have an origin behind an Application Load Balancer (ALB) in a VPC. The ALB is internet-facing and has a security group that allows inbound HTTPS traffic from CloudFront's IP ranges. Users in some regions report slow loading times. The company wants to reduce latency and improve performance. They are considering using Lambda@Edge and origin failover. However, they also notice that the ALB is receiving traffic directly from some IPs that are not CloudFront IPs, causing unnecessary load. What should a network engineer do to restrict access to the ALB to only CloudFront?

A.Update the ALB security group to allow inbound HTTPS only from the CloudFront managed prefix list

B.Use AWS WAF to block requests that do not come from CloudFront IPs

C.Configure the ALB to require a custom header (e.g., X-Origin-Verify) and validate it in the origin

D.Set up a VPC endpoint for CloudFront to route traffic privately

AnswerA

This restricts access to CloudFront IPs only.

Why this answer

The best practice is to restrict the ALB security group to the CloudFront managed prefix list (com.amazonaws.global.cloudfront.origin-facing). This dynamically allows only CloudFront IPs and automatically updates when CloudFront IPs change. Option C (custom header) is a good additional measure but not sufficient alone because attackers can mimic headers.

Option B (AWS WAF) can help block non-CloudFront traffic but is not the primary method and adds complexity. Option D (VPC endpoint) is not applicable because CloudFront does not use VPC endpoints; it communicates over the internet. Therefore, Option A is correct.

Practice this question →

291

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network team notices that traffic to a particular EC2 instance is taking a suboptimal path that goes through the internet instead of Direct Connect. The EC2 instance has both a private IP and a public IP. The on-premises router is advertising the VPC's CIDR block over BGP. What is the most likely cause?

A.The private VIF is not configured to route the VPC CIDR.

B.The security group on the EC2 instance is blocking traffic from the on-premises IP range.

C.The on-premises router is not advertising the VPC CIDR to the Direct Connect router.

D.The on-premises DNS is resolving the EC2 instance's public IP address instead of its private IP address.

AnswerD

When using Direct Connect, you should use private IP addresses to ensure traffic stays on the private network.

Why this answer

The on-premises DNS is resolving the EC2 instance's public IP address instead of its private IP address. When the on-premises router advertises the VPC CIDR over BGP, traffic destined for the VPC should use Direct Connect. However, if DNS returns the public IP, the on-premises hosts will send traffic to the internet (via the public IP) rather than through the private VIF, causing a suboptimal path.

This is a common misconfiguration where DNS resolution does not account for private connectivity.

Exam trap

The trap here is that candidates often focus on BGP routing issues (like option C) or security group misconfigurations (option B), but the real cause is a DNS resolution problem that diverts traffic to the public IP, bypassing the Direct Connect path entirely.

How to eliminate wrong answers

Option A is wrong because a private VIF inherently routes traffic for the VPC CIDR once the VIF is attached to the VPC and the on-premises router advertises the VPC CIDR; no additional routing configuration is required on the VIF itself. Option B is wrong because security groups filter traffic at the instance level based on IP addresses, but they do not influence the path the traffic takes; the suboptimal path occurs before the traffic reaches the security group. Option C is wrong because the question states the on-premises router is advertising the VPC CIDR over BGP, so this option directly contradicts the given information.

Practice this question →

292

Multi-Selectmedium

A company has a VPC with multiple subnets. They want to use VPC Flow Logs to capture network traffic metadata for troubleshooting. Which TWO of the following are valid destinations for VPC Flow Logs? (Select TWO.)

Select 2 answers

A.Amazon CloudWatch Logs log group

B.Amazon Kinesis Data Firehose delivery stream

C.AWS Lambda function

D.Amazon Simple Queue Service (SQS) queue

E.Amazon S3 bucket

AnswersA, E

CloudWatch Logs is a supported destination for VPC Flow Logs.

Why this answer

Amazon VPC Flow Logs can publish flow log data directly to an Amazon CloudWatch Logs log group. This is a native integration that allows you to store, monitor, and access flow log records using the CloudWatch Logs agent and API, enabling real-time analysis and metric filtering.

Exam trap

The ANS-C01 exam often tests that candidates confuse supported destinations (CloudWatch Logs and S3) with downstream processing services like Kinesis, Lambda, or SQS, which are not valid direct targets for VPC Flow Logs.

Practice this question →

293

MCQmedium

A company has a VPC with private subnets that use a NAT gateway for outbound internet access. The NAT gateway is in a public subnet with an Elastic IP. Users report that some applications are failing to connect to external services. Network engineers confirm that the NAT gateway is in the 'available' state and the route tables have a default route (0.0.0.0/0) pointing to the NAT gateway. What is the most likely cause?

A.The security group for the private instances is blocking outbound traffic.

B.The network ACL for the public subnet is blocking inbound traffic on ephemeral ports.

C.The NAT gateway has reached its connection limit.

D.The route table for the private subnets is missing a route to the internet gateway.

AnswerB

NACL must allow inbound traffic from the internet on ephemeral ports (1024-65535) for return traffic.

Why this answer

The network ACL for the public subnet is blocking inbound traffic on ephemeral ports. When a private instance initiates outbound traffic through the NAT gateway, the NAT gateway sends the traffic to the internet and expects return traffic on high-numbered ephemeral ports (1024–65535). If the public subnet's network ACL blocks inbound traffic on these ports, the return traffic cannot reach the NAT gateway, causing asymmetric routing and connection failures.

The NAT gateway itself is available and the route tables are correctly configured, so the issue lies in the stateful nature of security groups versus the stateless nature of network ACLs.

Exam trap

The ANS-C01 exam often tests the distinction between stateful security groups and stateless network ACLs, and the trap here is that candidates assume the NAT gateway's availability and correct route tables guarantee connectivity, overlooking the need for explicit inbound ephemeral port rules in the public subnet's network ACL.

How to eliminate wrong answers

Option A is wrong because security groups are stateful; if outbound traffic is allowed from the private instances, the corresponding return traffic is automatically permitted regardless of inbound rules. Option C is wrong because the NAT gateway connection limit (typically 55,000 concurrent connections per IP) is rarely reached in normal scenarios, and the question provides no evidence of high connection counts. Option D is wrong because the route table for the private subnets correctly has a default route (0.0.0.0/0) pointing to the NAT gateway, and the NAT gateway itself resides in a public subnet with a route to the internet gateway; the private subnets do not need a direct route to the internet gateway.

Practice this question →

294

MCQhard

A company uses AWS Direct Connect with a public VIF to access Amazon S3. They notice that traffic to S3 is taking a suboptimal path (going through the internet) instead of the Direct Connect connection. The VPC has a route table with a route for S3 prefix list via the virtual private gateway. What is the most likely cause?

A.The VPC does not have a VPC endpoint for S3

B.The public VIF is not associated with the correct Direct Connect gateway

C.The on-premises router is not advertising the S3 prefix list via BGP over the public VIF

D.The route table in the VPC does not have a route to the S3 prefix list via the virtual private gateway

AnswerC

S3 prefix must be advertised to route traffic over Direct Connect.

Why this answer

For traffic to use the Direct Connect public VIF, the on-premises router must advertise the specific prefixes (e.g., S3 prefix list) via BGP over the public VIF. Without this advertisement, the on-premises router will not have a route pointing to the Direct Connect link for S3 traffic, causing it to fall back to the internet path. The VPC route table already has a route for the S3 prefix list via the virtual private gateway, so the issue lies in the BGP advertisement from the on-premises side.

Exam trap

The trap here is that candidates often assume the VPC route table configuration is sufficient, but they overlook that the on-premises router must also advertise the destination prefixes via BGP over the public VIF for traffic to use the Direct Connect path.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint for S3 is not required for accessing S3 over a Direct Connect public VIF; the public VIF provides direct connectivity to AWS public services without needing a VPC endpoint. Option B is wrong because a public VIF is not associated with a Direct Connect gateway; Direct Connect gateways are used for private VIFs and transit VIFs, not public VIFs. Option D is wrong because the question explicitly states that the VPC route table already has a route for the S3 prefix list via the virtual private gateway, so the route is present.

Practice this question →

295

Multi-Selecthard

A company is using AWS Direct Connect to connect its on-premises network to a VPC via a private virtual interface (VIF) attached to a virtual private gateway (VGW). The company wants to add redundant connectivity using a second Direct Connect connection from a different provider. The network team proposes using a Direct Connect gateway (DXGW) with two private VIFs from different connections, each attached to the DXGW. The DXGW will be associated with the VGW. Which THREE steps are required to complete this configuration? (Choose three.)

Select 3 answers

A.Add routes to the VPC subnets' route tables pointing to the Direct Connect gateway.

B.Associate both private virtual interfaces with the same Direct Connect gateway.

C.Associate the Direct Connect gateway with the virtual private gateway.

D.Advertise the on-premises prefixes over both BGP sessions to enable active-active or failover.

E.Create a separate virtual private gateway for each Direct Connect connection.

AnswersB, C, D

Both VIFs connect to the same DXGW for redundancy.

Why this answer

To implement redundant Direct Connect connectivity using a Direct Connect gateway (DXGW), the correct steps are: associate both private virtual interfaces (VIFs) with the same DXGW (B), associate the DXGW with the virtual private gateway (VGW) (C), and advertise the on-premises prefixes over both BGP sessions to enable active-active or failover (D). Option A is incorrect because route tables in VPC subnets must point to the VGW, not the DXGW directly. Option E is incorrect because only one VGW is needed per VPC; separate VGWs would not provide the desired redundancy and would complicate routing.

Practice this question →

296

MCQeasy

A company wants to provide internet access to instances in a private subnet while ensuring that traffic is logged and inspected. The solution must be highly available within a single AWS Region. Which approach should the company use?

A.Deploy a NAT Gateway in each Availability Zone and configure the private subnet route tables to point to the NAT Gateway in the same AZ. Use Gateway Load Balancer endpoint for traffic inspection.

B.Launch a NAT instance in a public subnet and configure it as the default route for the private subnet.

C.Create a VPC endpoint for the internet and attach it to the private subnet.

D.Attach an Internet Gateway to the VPC and add a default route to it in the private subnet's route table.

AnswerA

NAT Gateways are highly available per AZ, and using one per AZ ensures availability. Gateway Load Balancer can inspect traffic.

Why this answer

It combines NAT Gateways (one per AZ) for highly available outbound internet access from private subnets with a Gateway Load Balancer endpoint for traffic inspection. NAT Gateways are managed, scale automatically, and are AZ-resilient when deployed in each AZ, while the Gateway Load Balancer endpoint allows traffic to be routed through third-party inspection appliances without disrupting the NAT path. This meets the requirements for high availability within a single Region and ensures all egress traffic is logged and inspected.

Exam trap

The trap here is that candidates often confuse a Gateway Load Balancer endpoint with a VPC Gateway endpoint (for S3/DynamoDB) or assume a single NAT Gateway is sufficient for high availability, overlooking the need for per-AZ deployment and the specific role of the Gateway Load Balancer in traffic inspection.

How to eliminate wrong answers

Option B is wrong because a single NAT instance in a public subnet is a single point of failure, lacks automatic failover, and does not provide the managed high availability required; it also does not inherently support traffic inspection via Gateway Load Balancer. Option C is wrong because a VPC endpoint (e.g., for S3 or DynamoDB) provides private connectivity to specific AWS services, not general internet access, and cannot route traffic to the public internet. Option D is wrong because attaching an Internet Gateway to the VPC and adding a default route to it in a private subnet's route table would make the subnet effectively public, allowing direct internet access without logging or inspection, and violates the requirement for a private subnet.

Practice this question →

297

Multi-Selecthard

A company is setting up AWS Transit Gateway with multiple VPC attachments and an AWS Direct Connect Gateway. The company wants to control which VPCs can communicate with each other and with the on-premises network. Which TWO actions should the company take to implement this?

Select 2 answers

A.Associate the Direct Connect Gateway with the Transit Gateway.

B.Establish VPC peering connections between VPCs that need to communicate.

C.Use security groups to control traffic between VPCs.

D.Configure Transit Gateway peering attachments for inter-region connectivity.

E.Create separate Transit Gateway route tables for different groups of VPCs.

AnswersA, E

This enables on-premises connectivity through the transit gateway.

Why this answer

To route traffic from on-premises networks through AWS Direct Connect to VPCs attached to a Transit Gateway, the Direct Connect Gateway must be associated with the Transit Gateway. This association creates a dedicated attachment that enables the Transit Gateway to exchange routes with the Direct Connect Gateway, allowing seamless connectivity between on-premises and VPC resources.

Exam trap

The ANS-C01 exam often tests the misconception that security groups can be used to filter traffic between VPCs at the Transit Gateway level, but security groups only apply to individual EC2 instances or ENIs, not to network transit paths like Transit Gateway attachments.

Practice this question →

298

MCQmedium

A company is deploying a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group across three Availability Zones, and an Amazon RDS for MySQL database. The ALB has a target group that routes traffic to the EC2 instances on TCP port 8080. The security group for the EC2 instances allows inbound traffic from the ALB's security group on port 8080. Users report intermittent connectivity issues to the application. A network engineer reviews the VPC Flow Logs and notices that traffic from the ALB to the EC2 instances is being recorded as 'REJECT' for some requests. What is the most likely cause of this issue?

A.The network ACL associated with the EC2 instances' subnet does not have an outbound rule to allow traffic from the EC2 instances to the ALB on ephemeral ports.

B.The ALB's security group is blocking inbound traffic from the EC2 instances on the response path.

C.The ALB's target group health check is misconfigured, causing the ALB to mark instances as unhealthy and stop sending traffic.

D.The security group on the EC2 instances is stateful and automatically allows return traffic; the issue cannot be security group related.

AnswerA

The network ACL is stateless and must allow return traffic. Missing outbound rules cause REJECT.

Why this answer

The network ACL (NACL) is stateless and must have explicit outbound rules to allow return traffic from the EC2 instances back to the ALB on ephemeral ports. Since the ALB initiates connections to the EC2 instances on TCP port 8080, the return traffic from the EC2 instances uses ephemeral ports (typically 1024-65535) destined for the ALB's source port. Without an outbound rule in the subnet's NACL allowing this traffic, the NACL will reject the response packets, causing intermittent REJECT entries in VPC Flow Logs.

Exam trap

The trap here is that candidates often focus on security groups being stateful and forget that network ACLs are stateless and require explicit rules for return traffic, especially on ephemeral ports.

How to eliminate wrong answers

Option B is wrong because security groups are stateful, meaning if the ALB's security group allows outbound traffic to the EC2 instances, the return traffic from the EC2 instances is automatically allowed regardless of inbound rules. Option C is wrong because a misconfigured health check would cause the ALB to mark instances as unhealthy and stop sending traffic entirely, not cause intermittent REJECT records for traffic that is already being sent. Option D is wrong because while the EC2 instances' security group is stateful and automatically allows return traffic, the issue is with the network ACL (stateless) on the subnet, not the security group.

Practice this question →

299

MCQeasy

A network engineer is setting up a Direct Connect connection from an on-premises data center to AWS. The connection uses a private VIF to connect to a VPC via a Direct Connect gateway. The on-premises network is advertising a BGP prefix 10.0.0.0/16, which overlaps with the VPC CIDR 10.0.0.0/16. What is the expected behavior?

A.The VPC will automatically reassign a new CIDR to avoid the conflict.

B.The BGP session will fail to establish due to the prefix conflict.

C.The BGP session will be established, but the overlapping prefix will be ignored and not programmed into the VPC route tables.

D.The on-premises prefix will take precedence and override the VPC route.

AnswerC

AWS does not allow overlapping prefixes to be injected into VPC route tables to prevent routing conflicts.

Why this answer

When a BGP prefix advertised over a Direct Connect private VIF overlaps with the VPC CIDR, the BGP session establishes successfully, but AWS ignores the overlapping prefix and does not install it into the VPC route tables. This is because AWS always prefers the local VPC route over any propagated BGP route for the same prefix, preventing traffic destined for the VPC from being blackholed or misrouted to on-premises.

Exam trap

The trap here is that candidates assume BGP session failure due to prefix overlap, but BGP itself has no mechanism to reject a session based on prefix overlap; the overlap only affects route installation, not session state.

How to eliminate wrong answers

Option A is wrong because AWS does not automatically reassign VPC CIDRs; CIDR changes require manual action and cannot be triggered by a BGP prefix overlap. Option B is wrong because the BGP session establishes normally; the overlap does not affect BGP session establishment or keepalive messages. Option D is wrong because the on-premises prefix does not take precedence; the VPC's local route always has a higher administrative priority than any propagated BGP route, so the on-premises route is ignored.

Practice this question →

300

MCQmedium

A company is implementing a hybrid network using AWS Direct Connect. They have a virtual private gateway (VGW) attached to their VPC and a Direct Connect gateway (DXGW) with a private virtual interface (VIF) to their on-premises router. They have established a BGP session between the on-premises router and the VGW. The on-premises network can reach EC2 instances in the VPC, but the VPC instances cannot reach on-premises resources. What is the most likely cause?

A.The virtual private gateway is not attached to the VPC

B.The VPC has a VPC endpoint for S3 that is causing a routing conflict

C.The VPC route tables lack a route for the on-premises CIDR pointing to the virtual private gateway

D.The BGP session is not advertising the on-premises CIDR to the VGW

AnswerC

Without a route, VPC instances do not know to send traffic to the VGW for on-premises destinations.

Why this answer

For instances in a VPC to reach on-premises resources over Direct Connect, the VPC route tables must have a route for the on-premises CIDR that points to the virtual private gateway (VGW). Without this route, traffic from the VPC to the on-premises network will not be forwarded to the VGW, even though the BGP session is established and the on-premises side can reach the VPC. Option A is incorrect because the VGW is attached to the VPC (otherwise on-premises could not reach EC2 instances).

Option B is incorrect because a VPC endpoint for S3 does not cause routing conflicts for on-premises traffic. Option D is incorrect because the BGP session is established and the on-premises CIDR is being advertised (otherwise on-premises could not reach the VPC).

Practice this question →