Courseiva

CCNA Network Implementation Questions

75 of 416 questions · Page 5/6 · Network Implementation · Answers revealed

Practice these questionsDomain overviewAll questions
301
MCQmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the public subnet is configured as a NAT instance. The company wants to replace the NAT instance with a NAT gateway for better availability and maintenance. After creating a NAT gateway in the public subnet and updating the route table of the private subnet, traffic from the private subnet cannot reach the internet. What is the MOST likely cause?

A.The public subnet's route table still points to the NAT instance for internet traffic.
B.The security group attached to the NAT gateway is blocking outbound traffic.
C.The private subnet's route table has a route for 0.0.0.0/0 pointing to the NAT instance instead of the NAT gateway.
D.The NAT gateway does not have an Elastic IP address associated with it.
AnswerD

A NAT gateway requires an Elastic IP for outbound traffic.

Why this answer

A NAT gateway requires an Elastic IP address to function as a gateway for outbound internet traffic. Without an Elastic IP, the NAT gateway cannot perform source network address translation (SNAT), so instances in the private subnet cannot reach the internet. This is the most likely cause given that the route table update was already performed.

Exam trap

The trap here is that candidates may assume a NAT gateway can function without an Elastic IP, similar to a NAT instance, or they may incorrectly focus on route table misconfigurations when the route table was already updated.

How to eliminate wrong answers

Option A is wrong because the public subnet's route table does not affect traffic from the private subnet; the private subnet's route table controls its outbound traffic. Option B is wrong because NAT gateways do not use security groups; they use network ACLs at the subnet level, and security groups are not applicable to NAT gateways. Option C is wrong because the question states the route table was updated to point to the NAT gateway, so a lingering route to the NAT instance would be a configuration error that contradicts the given scenario.

Practice this question →
302
MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. They also have a site-to-site VPN as a backup. The on-premises network advertises the same prefix via BGP over both connections. The company wants to prefer the Direct Connect path. What configuration achieves this?

A.Set the Multi-Exit Discriminator (MED) on the VPN advertisement to a lower value.
B.Prepend the AS path on the Direct Connect advertisement to make it longer.
C.Configure the Direct Connect BGP session with a higher local preference (e.g., 200) than the VPN BGP session.
D.Configure the VPN BGP session with a higher local preference than the Direct Connect session.
AnswerC

Higher local preference makes Direct Connect preferred.

Why this answer

Local preference is a BGP attribute used to influence outbound traffic from the local AS. By setting a higher local preference (e.g., 200) on the Direct Connect BGP session, the router will prefer that path over the VPN session (default local preference 100) for the same prefix. This ensures traffic from the VPC to on-premises uses Direct Connect as the primary path.

Exam trap

The ANS-C01 exam often tests the misconception that MED is used for inbound traffic engineering, but here the requirement is to control outbound traffic from the VPC, where local preference is the correct attribute, not MED or AS path prepending.

How to eliminate wrong answers

Option A is wrong because setting a lower MED on the VPN advertisement would make the VPN path more preferred (lower MED is better), which is the opposite of the desired outcome. Option B is wrong because prepending the AS path on the Direct Connect advertisement makes it longer, which reduces its preference (shorter AS path is preferred), so this would steer traffic away from Direct Connect. Option D is wrong because configuring a higher local preference on the VPN BGP session would make the VPN path preferred over Direct Connect, contradicting the requirement to prefer Direct Connect.

Practice this question →
303
Multi-Selecteasy

A company has a VPC with a public subnet and a private subnet. They want to allow instances in the private subnet to download patches from the internet. Which THREE components are required? (Select THREE.)

Select 3 answers
A.AWS Direct Connect connection
B.Internet Gateway attached to the VPC
C.Elastic IP address assigned to the NAT Gateway
D.Route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway
E.NAT Gateway deployed in the public subnet
AnswersB, D, E

The NAT Gateway uses the Internet Gateway to reach the internet.

Why this answer

An Internet Gateway (IGW) is required to provide a target in the VPC's route tables for internet-bound traffic. The NAT Gateway must be deployed in a public subnet and assigned an Elastic IP address so that it can route traffic through the IGW to the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, enabling instances in the private subnet to initiate outbound connections to the internet for patch downloads while remaining inaccessible from the internet.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT Gateway alone in a private subnet can provide internet access, but the NAT Gateway must be deployed in a public subnet with an Internet Gateway attached to the VPC and a default route pointing to the IGW in that public subnet's route table.

Practice this question →
304
MCQmedium

A company has a Direct Connect connection with a private VIF to a VPC. They also have a Site-to-Site VPN connection to the same VPC as a backup. The on-premises router is advertising the same prefixes over both connections. The company wants to ensure that traffic uses Direct Connect when available and fails over to VPN if Direct Connect goes down. Which configuration should be applied?

A.Set a higher MED value on the Direct Connect BGP advertisements.
B.Disable BGP on the VPN connection to force traffic to Direct Connect.
C.Prepend AS path on the BGP advertisements over the VPN connection to make the path less preferred.
D.Set a higher local preference on the VPN BGP advertisements.
AnswerC

AS path prepending makes the VPN path longer, so Direct Connect path (shorter AS path) is preferred.

Why this answer

To prefer Direct Connect over VPN, adjust BGP attributes on the on-premises router. Prepend AS path on the VPN BGP advertisements to increase the AS path length, making the Direct Connect path shorter and thus preferred. This ensures failover to VPN if Direct Connect fails.

Option A is incorrect because setting higher MED on Direct Connect would make it less preferred, not more. Option B is incorrect because disabling BGP on VPN removes the backup connection entirely. Option D is incorrect because setting higher local preference on VPN BGP advertisements would make VPN preferred, which is the opposite of the desired behavior.

Local preference is typically set on the AWS side, not on-premises.

Practice this question →
305
MCQmedium

A company is deploying a multi-tier web application in a VPC. The web tier must be accessible from the internet, while the application tier must only be accessible from the web tier. The database tier must only be accessible from the application tier. Which design best meets these requirements?

A.Place all tiers in public subnets and use security groups to control traffic between tiers.
B.Place the web tier in public subnets with an internet gateway, and the application and database tiers in private subnets. Use security groups to allow traffic from the web tier to the application tier, and from the application tier to the database tier.
C.Place all tiers in the same subnet and use network ACLs to restrict traffic between tiers.
D.Place the web tier in a private subnet and use a NAT gateway for outbound internet access. Place the application and database tiers in public subnets.
AnswerB

Correct design: public subnet with IGW for web, private subnets for app and DB, security groups restrict traffic.

Why this answer

It places the web tier in a public subnet with an Internet Gateway (IGW) for direct internet access, while the application and database tiers reside in private subnets with no direct internet path. Security groups act as stateful virtual firewalls at the instance level, allowing you to specify inbound rules that permit traffic only from the web tier security group to the application tier, and from the application tier security group to the database tier. This layered approach enforces the principle of least privilege and meets the access requirements without exposing the internal tiers to the internet.

Exam trap

The ANS-C01 exam often tests the misconception that security groups alone can secure tiers placed in public subnets, but the trap here is that a public subnet with an Internet Gateway route inherently allows inbound internet traffic unless explicitly blocked by a network ACL, so the application and database tiers must be placed in private subnets to prevent direct internet access.

How to eliminate wrong answers

Option A is wrong because placing all tiers in public subnets exposes the application and database tiers to the internet, violating the requirement that they must only be accessible from the preceding tier; security groups alone cannot prevent direct internet access if the subnets have a route to an Internet Gateway. Option C is wrong because placing all tiers in the same subnet and relying solely on network ACLs (which are stateless and require explicit rules for both inbound and outbound traffic) is overly complex, error-prone, and does not provide the same granular, stateful control as security groups; it also fails to isolate tiers at the subnet level. Option D is wrong because placing the web tier in a private subnet with a NAT gateway prevents direct inbound internet access (the web tier must be accessible from the internet), and placing the application and database tiers in public subnets exposes them unnecessarily, contradicting the requirement for restricted access.

Practice this question →
306
MCQeasy

A company needs to connect its on-premises network to a VPC using AWS Direct Connect. The company wants to use a single Direct Connect connection to connect to multiple VPCs in the same region. Which configuration should be used?

A.Create a private VIF for each VPC
B.Use a VPN connection to extend the Direct Connect to other VPCs
C.Use a Transit Gateway to connect the Direct Connect to multiple VPCs
D.Create a Direct Connect Gateway and associate it with multiple VPCs
AnswerD

A Direct Connect Gateway can be associated with up to 10 VPCs per region.

Why this answer

A Direct Connect Gateway allows a single Direct Connect connection (via a private virtual interface) to be associated with multiple VPCs in the same region (or across regions). The Direct Connect Gateway acts as a hub, enabling transitive routing between the on-premises network and all associated VPCs without needing separate private VIFs per VPC.

Exam trap

The trap here is that candidates often confuse the role of a Transit Gateway with a Direct Connect Gateway, assuming that a Transit Gateway alone can directly terminate a Direct Connect private VIF, when in fact a Direct Connect Gateway is required as an intermediary to aggregate multiple VPC attachments.

How to eliminate wrong answers

Option A is wrong because creating a private VIF for each VPC would require multiple Direct Connect connections or multiple VLANs on a single connection, which is inefficient and does not scale; a single private VIF can only terminate on a single virtual private gateway or Direct Connect Gateway. Option B is wrong because using a VPN connection to extend Direct Connect to other VPCs adds unnecessary complexity, latency, and bandwidth constraints, and it defeats the purpose of using Direct Connect for low-latency, high-bandwidth connectivity. Option C is wrong because a Transit Gateway can be used to connect multiple VPCs to a Direct Connect connection, but it requires a Direct Connect Gateway attachment to the Transit Gateway; the question asks for the configuration that directly uses a single Direct Connect connection to connect to multiple VPCs, and the Direct Connect Gateway is the native AWS service designed for this purpose, not the Transit Gateway itself.

Practice this question →
307
MCQeasy

A company has deployed a VPC with public and private subnets. The private subnets need outbound internet access for software updates. Which service should be used to provide this access without exposing the instances to inbound traffic?

A.Attach an Internet Gateway to the VPC and add a default route to it from the private subnets.
B.Set up a VPN connection to an on-premises network that has internet access.
C.Use a Direct Connect connection to route traffic through an on-premises internet gateway.
D.Deploy a NAT Gateway in a public subnet and add a default route to it from the private subnets.
AnswerD

NAT Gateway provides outbound-only internet access.

Why this answer

A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet’s route table directs default traffic (0.0.0.0/0) to the NAT Gateway, which performs source network address translation (SNAT) to the gateway’s Elastic IP, enabling outbound-only access.

Exam trap

The trap here is that candidates often confuse an Internet Gateway (which allows bidirectional traffic) with a NAT Gateway (which allows only outbound traffic), leading them to select Option A despite the requirement to block inbound traffic.

How to eliminate wrong answers

Option A is wrong because attaching an Internet Gateway to the VPC and adding a default route from private subnets would directly expose those instances to inbound internet traffic, violating the requirement to prevent inbound access; an Internet Gateway allows bidirectional traffic. Option B is wrong because setting up a VPN connection to an on-premises network that has internet access adds unnecessary complexity and latency, and it does not natively provide outbound-only internet access from the VPC without additional routing and firewall rules. Option C is wrong because using a Direct Connect connection to route traffic through an on-premises internet gateway is an over-engineered solution that introduces dependency on on-premises infrastructure, higher cost, and potential bandwidth bottlenecks; it is not the simplest or most appropriate service for providing outbound-only internet access from private subnets.

Practice this question →
308
MCQeasy

A network engineer is troubleshooting connectivity between an EC2 instance in a VPC and an on-premises server connected via AWS Site-to-Site VPN. The ping from the EC2 instance to the on-premises server fails. The VPN tunnel status shows 'UP'. Which configuration should the engineer check first?

A.Ensure the customer gateway device is configured with the correct public IP address
B.Check that the pre-shared key matches on both sides
C.Check the route table associated with the EC2 instance's subnet for a route to the on-premises network
D.Verify that the VPN tunnel is using the correct encryption algorithms
AnswerC

Without a route pointing traffic to the virtual private gateway, the VPN cannot forward packets.

Why this answer

Even when the VPN tunnel is UP, traffic from the EC2 instance to the on-premises server will be dropped if the VPC route table associated with the instance's subnet does not contain a route pointing to the on-premises network via the virtual private gateway (VGW). The ping failure in this scenario is most likely due to missing routing, not tunnel misconfiguration, since the tunnel status is UP.

Exam trap

The ANS-C01 exam often tests the misconception that a UP VPN tunnel guarantees end-to-end connectivity, but the trap here is that routing within the VPC is a separate concern that must be explicitly configured.

How to eliminate wrong answers

Option A is wrong because the customer gateway device's public IP address is used to establish the VPN tunnel; if it were incorrect, the tunnel would not be UP. Option B is wrong because a mismatched pre-shared key would prevent the IKE phase 1 negotiation from completing, causing the tunnel to fail to reach UP status. Option D is wrong because incorrect encryption algorithms would also prevent the tunnel from establishing; the tunnel being UP indicates that both sides have successfully negotiated IPsec parameters.

Practice this question →
309
MCQhard

A company has an AWS Direct Connect connection with a private VIF to a VPC. The VPC has multiple subnets across two Availability Zones. The company wants to use the Direct Connect connection as the primary path for all traffic from on-premises to the VPC, and use a Site-to-Site VPN as a backup. The on-premises router is configured to advertise a default route via BGP over the Direct Connect, and the VPN also advertises a default route. Which configuration ensures that the Direct Connect path is preferred over the VPN?

A.Disable route propagation from the VPN in the VPC route tables to ensure Direct Connect routes take precedence.
B.Set a higher local preference on the Direct Connect BGP session on the on-premises router.
C.Decrease the Multi-Exit Discriminator (MED) value on the Direct Connect BGP advertisements from AWS.
D.Configure AS_PATH prepending on the VPN BGP advertisements from the on-premises router to make the VPN path longer.
AnswerD

Longer AS_PATH makes the route less preferred.

Why this answer

AS_PATH prepending increases the AS path length for routes advertised over the VPN, making them less preferred compared to the Direct Connect routes when both paths advertise a default route. BGP selects the path with the shortest AS_PATH length when all other attributes are equal, so prepending on the VPN ensures Direct Connect is the primary path.

Exam trap

The trap here is that candidates often confuse local preference (which influences outbound traffic from on-premises) with AS_PATH prepending (which influences inbound traffic to the VPC), and they may incorrectly assume that disabling route propagation or adjusting MED is the correct way to prioritize Direct Connect over VPN.

How to eliminate wrong answers

Option A is wrong because disabling route propagation from the VPN in the VPC route tables would remove the VPN routes entirely, eliminating the backup path rather than just influencing path preference. Option B is wrong because local preference is an inbound BGP attribute typically set on the router receiving the routes (in this case, the on-premises router), and setting a higher local preference on the Direct Connect session would affect outbound traffic from on-premises, not inbound traffic to the VPC; the question asks about traffic from on-premises to the VPC, where AWS-side path selection is based on BGP attributes like AS_PATH and MED. Option C is wrong because decreasing the MED value on Direct Connect advertisements from AWS would make the Direct Connect path more preferred for traffic entering AWS, but MED is a metric that compares paths from the same neighboring AS; since Direct Connect and VPN are different AS paths, MED is not the primary tiebreaker, and the default route from VPN would still be compared using AS_PATH length.

Practice this question →
310
MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to establish a site-to-site VPN connection to an on-premises network with a CIDR of 192.168.0.0/16. The VPN tunnel is up, but traffic from the VPC to on-premises is not flowing. Which of the following is the most likely cause?

A.The security groups do not allow outbound traffic.
B.The NACLs are blocking outbound traffic.
C.The VPC route table does not have a route for 192.168.0.0/16 pointing to the virtual private gateway.
D.The VPN connection is in the wrong AWS region.
AnswerC

Missing route prevents traffic from leaving VPC.

Why this answer

For traffic from a VPC to an on-premises network over a site-to-site VPN, the VPC route table must contain a route for the on-premises CIDR (192.168.0.0/16) pointing to the virtual private gateway (VGW). Without this route, the VPC has no path to forward packets destined for 192.168.0.0/16, even though the VPN tunnel is up. Security groups and NACLs are stateful or stateless filters, but they do not create routing paths.

Exam trap

The trap here is that candidates often confuse routing with security filtering (security groups or NACLs) and assume the tunnel being up guarantees traffic flow, but AWS requires explicit route table entries to direct traffic to the virtual private gateway.

How to eliminate wrong answers

Option A is wrong because security groups are stateful and automatically allow outbound traffic for established connections; they do not block outbound traffic unless explicitly denied, and the default security group allows all outbound traffic. Option B is wrong because NACLs are stateless and can block traffic, but the question states the VPN tunnel is up and the issue is routing, not filtering; NACLs would affect both directions if misconfigured, but the primary missing element is a route. Option D is wrong because a VPN connection is regional and must be in the same region as the VPC; if it were in the wrong region, the VPN tunnel would not establish at all, but the tunnel is up, so region mismatch is not the cause.

Practice this question →
311
Multi-Selectmedium

Which TWO of the following are valid methods to connect multiple VPCs in the same AWS Region? (Choose TWO.)

Select 2 answers
A.Internet gateway
B.AWS Site-to-Site VPN
C.VPC peering
D.AWS Transit Gateway
E.AWS Direct Connect
AnswersC, D

Direct connection between two VPCs.

Why this answer

VPC peering is a valid method to connect multiple VPCs in the same AWS Region. It uses the AWS global network to privately route traffic between VPCs using IPv4 or IPv6 addresses, with no single point of failure or bandwidth bottleneck. Each VPC peering connection is a one-to-one relationship, so to connect multiple VPCs, you must create a mesh of peering connections.

Exam trap

The ANS-C01 exam often tests the misconception that an internet gateway or Site-to-Site VPN can be used for VPC-to-VPC connectivity, but these services are specifically for internet or on-premises access, not for inter-VPC routing within the same Region.

Practice this question →
312
MCQhard

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and an IPv6 CIDR of 2001:db8:1234::/56. The company hosts a web application on IPv4-only EC2 instances in a private subnet. The application must be accessible from the internet via IPv6. The company has an internet-facing Application Load Balancer (ALB) with dual-stack IP address type. The ALB is in a public subnet. The target group is configured with IP address type IPv4. Users report that they can access the application via IPv4 but not via IPv6. The ALB security group allows inbound HTTP/HTTPS from ::/0. What is the MOST likely cause?

A.The public subnet does not have an associated IPv6 CIDR.
B.The target group is configured with IP address type IPv4, but the ALB must use IPv6 to communicate with the targets.
C.The ALB is configured as IPv4-only instead of dual-stack.
D.The private subnet's route table does not have an IPv6 route to the NAT gateway or egress-only internet gateway.
AnswerA

Correct. Without an IPv6 CIDR on the public subnet, the ALB cannot obtain an IPv6 address, so it cannot receive IPv6 traffic despite being configured as dual-stack.

Why this answer

The most likely cause is that the public subnet does not have an associated IPv6 CIDR. For an ALB to accept IPv6 traffic, it must have an IPv6 address assigned to its network interface. This requires the public subnet to have an IPv6 CIDR block attached.

Even though the ALB is configured as dual-stack, without an IPv6 CIDR on the subnet, the ALB cannot obtain an IPv6 address and therefore cannot receive IPv6 traffic. Option B is incorrect because an ALB can forward IPv6 client traffic to IPv4 targets using IPv4 communication; the target group IP address type does not need to be IPv6. Option C is false as the ALB is dual-stack.

Option D is irrelevant because the private subnet's route table does not affect ALB-to-target communication.

Exam trap

Candidates often assume that a dual-stack ALB automatically gets an IPv6 address, but it also requires the subnet to have an IPv6 CIDR.

Practice this question →
313
MCQmedium

A company is setting up a Direct Connect connection to connect its on-premises data center to AWS. The connection is established, and a private virtual interface (VIF) is configured. The on-premises router can ping the VIF's Amazon side IP address, but cannot ping an EC2 instance in the VPC. The VPC has a virtual private gateway attached, and the route tables are correctly configured. What should the company check next?

A.Verify that the on-premises router is advertising the VPC CIDR to the Direct Connect router.
B.Check that the NACLs on the EC2 instance's subnet allow inbound ICMP.
C.Confirm that the private VIF is associated with the correct virtual private gateway.
D.Ensure that BGP is established and receiving routes.
AnswerA

The on-premises router must advertise the VPC CIDR for return traffic.

Why this answer

The on-premises router can ping the VIF's Amazon side IP, confirming that Layer 2 and Layer 3 connectivity over the Direct Connect link is working, and BGP is established. However, the inability to ping the EC2 instance indicates that return traffic from the VPC is not reaching the on-premises network. For return traffic to be routed correctly, the on-premises router must advertise the VPC CIDR (or a specific prefix) to the Direct Connect router via BGP; otherwise, the AWS side will not forward traffic destined for the on-premises network over the VIF.

Exam trap

The trap here is that candidates assume BGP being established (as evidenced by a successful ping to the VIF Amazon side IP) means all routing is correct, but they overlook the requirement for the on-premises router to advertise the VPC CIDR to enable return traffic.

How to eliminate wrong answers

Option B is wrong because the issue is not about inbound ICMP to the EC2 instance; the ping fails due to missing return path routing, not because of security group or NACL filtering. Option C is wrong because the private VIF is already associated with a virtual private gateway (VGW) and the VPC route tables are correctly configured, so the VIF association is not the problem. Option D is wrong because the on-premises router can ping the VIF's Amazon side IP, which proves that BGP is established and routes are being exchanged; the problem is specifically that the on-premises router is not advertising the VPC CIDR back to AWS.

Practice this question →
314
MCQmedium

A company has set up a transit gateway with attachments to VPC-A and VPC-B. The transit gateway route table shows routes to both VPCs and a blackhole for 0.0.0.0/0. VPC-A's public subnet route table sends 10.1.0.0/16 traffic to the transit gateway. However, an EC2 instance in VPC-A's public subnet cannot reach an instance in VPC-B. What is the most likely cause?

A.VPC-B's route table does not have a route to VPC-A's CIDR via the transit gateway.
B.VPC-A's route table does not have a route to the transit gateway.
C.The transit gateway route table does not have a route for 10.0.0.0/16.
D.The blackhole route in the transit gateway is blocking traffic between VPCs.
AnswerA

For bidirectional communication, VPC-B must also have a route back to VPC-A via the transit gateway.

Why this answer

For traffic to flow from VPC-A to VPC-B via a transit gateway, both VPCs must have routes in their route tables pointing to the transit gateway for the other VPC's CIDR. Since VPC-A's route table sends 10.1.0.0/16 (VPC-B's CIDR) to the transit gateway, but VPC-B's route table lacks a return route to VPC-A's CIDR via the transit gateway, the return traffic from VPC-B is dropped, causing connectivity failure.

Exam trap

AWS often tests the misconception that a transit gateway route table alone ensures bidirectional connectivity, when in fact each VPC's subnet route tables must have explicit routes for the other VPC's CIDR to enable return traffic.

How to eliminate wrong answers

Option B is wrong because VPC-A's route table already has a route to the transit gateway (it sends 10.1.0.0/16 traffic to the transit gateway), so this is not the issue. Option C is wrong because the transit gateway route table shows routes to both VPCs, and the problem is about VPC-B's missing return route, not a missing route in the transit gateway for 10.0.0.0/16. Option D is wrong because the blackhole route for 0.0.0.0/0 in the transit gateway only drops traffic destined for the internet, not traffic between VPCs, which is handled by the specific VPC routes.

Practice this question →
315
MCQeasy

A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN connection uses static routes. Recently, the on-premises network administrator added a new subnet (10.0.3.0/24) and needs to ensure that traffic to this subnet is routed through the VPN tunnel. What must be done in the AWS VPC to enable this connectivity?

A.Update the customer gateway configuration
B.Enable route propagation on the VPN connection
C.Create a new VPN connection for the new subnet
D.Add a static route for 10.0.3.0/24 in the VPN connection's route table
AnswerD

Correct. You need to add a static route for 10.0.3.0/24 in the VPN connection's route table so that traffic to that subnet is routed through the VPN tunnel.

Why this answer

For a Site-to-Site VPN connection using static routes, the on-premises network administrator must add a new static route in the VPC route table for the new subnet (10.0.3.0/24), pointing to the virtual private gateway. Option D accomplishes this by adding a static route in the VPN connection's route table. Route propagation (Option B) is only available when the VPN uses BGP dynamic routing, not static routes.

Options A and C are incorrect because the customer gateway configuration does not affect VPC routing, and creating a new VPN connection is unnecessary.

Exam trap

The trap is that candidates might think that enabling route propagation (Option B) works for static route VPNs, but propagation is only supported with BGP. For static routes, you must manually add a static route to the VPC route table.

How to eliminate wrong answers

Option A is wrong because the customer gateway configuration represents the on-premises router's public IP and BGP ASN (if used), not the routes; updating it does not add routes to the VPC route table. Option B is wrong because route propagation is only applicable to BGP-based VPN connections (dynamic routing), not static route VPNs; enabling it on a static route VPN has no effect. Option C is wrong because creating a new VPN connection is unnecessary and wasteful; you can add multiple static routes to the same VPN connection, and a single tunnel can handle multiple subnets.

Practice this question →
316
MCQmedium

A company is deploying a web application across multiple Availability Zones in a single region. They want to distribute incoming traffic evenly across all healthy EC2 instances. Which AWS service should be used as the entry point?

A.Application Load Balancer (ALB)
B.Amazon CloudFront
C.Network Load Balancer (NLB)
D.Amazon Route 53 with simple routing
AnswerA

Layer 7 load balancer with health checks.

Why this answer

An Application Load Balancer (ALB) operates at Layer 7 and can distribute HTTP/HTTPS traffic across multiple targets in different Availability Zones. It supports health checks and round-robin routing to evenly distribute incoming requests across healthy EC2 instances, making it the correct entry point for a web application requiring even traffic distribution across AZs.

Exam trap

The trap here is that candidates often confuse the Network Load Balancer (NLB) as the default choice for all load balancing, but the question specifies a web application (HTTP/HTTPS) requiring even distribution, which is a Layer-7 use case best served by the ALB, not the NLB.

How to eliminate wrong answers

Option B is wrong because Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations; it does not natively distribute traffic evenly across EC2 instances in a region and is not designed as a direct entry point for load balancing. Option C is wrong because a Network Load Balancer (NLB) operates at Layer 4 and handles TCP/UDP traffic, but it is not optimized for HTTP/HTTPS web applications and does not provide the same layer-7 features (e.g., path-based routing, host-based routing) that an ALB offers for even distribution. Option D is wrong because Amazon Route 53 with simple routing returns a fixed set of IP addresses without considering instance health or load, so it cannot evenly distribute traffic across healthy instances; it lacks health-check-based failover and load-aware distribution.

Practice this question →
317
MCQhard

A company is implementing a multi-region architecture with VPCs in us-east-1 and eu-west-1. They want to connect these VPCs using a Transit Gateway and ensure that traffic between regions can be inspected by a firewall in us-east-1. Which configuration is required?

A.Establish a VPN connection between the two VPCs and route traffic through the firewall.
B.Create a Transit Gateway in each region, peer them, and configure route tables to send inter-region traffic through the inspection VPC in us-east-1.
C.Create a VPC peering connection between the two VPCs and update route tables.
D.Use a Direct Connect gateway to connect the two VPCs directly.
AnswerB

Transit Gateway peering enables cross-region connectivity, and route tables can steer traffic for inspection.

Why this answer

It uses Transit Gateway inter-region peering to connect the two regions, and by attaching an inspection VPC (with a firewall) in us-east-1 to the Transit Gateway, you can route all inter-region traffic through that VPC for inspection. The Transit Gateway route tables in each region are configured to send traffic destined for the other region to the inspection VPC attachment, ensuring traffic is inspected before being forwarded.

Exam trap

The trap here is that candidates often confuse VPC peering (which is non-transitive) with Transit Gateway peering (which supports transitive routing through inspection VPCs), leading them to select Option C incorrectly.

How to eliminate wrong answers

Option A is wrong because establishing a VPN connection between the two VPCs does not inherently provide traffic inspection through a firewall in us-east-1; it would require complex manual routing and does not leverage Transit Gateway for centralized inspection. Option C is wrong because VPC peering does not support transitive routing, so you cannot route traffic through an inspection VPC in us-east-1; traffic would flow directly between the peered VPCs without inspection. Option D is wrong because a Direct Connect gateway is used for connecting on-premises networks to VPCs, not for inter-region VPC connectivity, and it does not provide a mechanism for traffic inspection between regions.

Practice this question →
318
MCQmedium

A company has a Direct Connect connection with a single private virtual interface (VIF) to a virtual private gateway (VGW) attached to a VPC. The VPC CIDR is 10.0.0.0/16. The on-premises CIDR is 172.16.0.0/12. The BGP session is established, and the on-premises router is advertising the 172.16.0.0/12 route to the VGW. The VGW is configured to propagate routes to the VPC route tables. However, instances in the VPC cannot reach on-premises resources. The VPC route table shows a propagated route for 172.16.0.0/12 with a target of the VGW. What is the most likely issue?

A.The security groups for the VPC instances do not allow outbound traffic to the on-premises network
B.The VPC route table does not have a route for the on-premises CIDR
C.The on-premises router does not have a route to the VPC CIDR via the Direct Connect interface
D.The BGP session is not advertising the VPC CIDR to the on-premises router
AnswerC

Without a return route, traffic cannot reach the VPC.

Why this answer

The on-premises router must also have a route back to the VPC CIDR via the Direct Connect interface for traffic to flow bidirectionally. Option A is wrong because security groups are stateful, so outbound traffic is automatically allowed. Option B is wrong because the VPC route table does contain the propagated route for 172.16.0.0/12.

Option D is wrong because the BGP session is established and the VGW does not need to advertise the VPC CIDR for outbound traffic; the problem is the lack of a return route on the on-premises router.

Practice this question →
319
MCQhard

A company is troubleshooting connectivity between two VPCs (VPC-A and VPC-B) that are peered together. Both VPCs are in the same region. VPC-A has a CIDR of 10.0.0.0/16 and VPC-B has a CIDR of 10.0.0.0/16. The peering connection is established and the route tables are updated. However, EC2 instances in VPC-A cannot ping EC2 instances in VPC-B. What is the most likely cause?

A.The route tables do not have routes to the private IP addresses of the instances.
B.The VPCs have overlapping CIDR blocks.
C.The security groups in VPC-B do not allow inbound ICMP traffic from VPC-A.
D.The VPCs are in different regions and peering does not work across regions.
AnswerB

Overlapping CIDRs prevent proper routing in VPC peering.

Why this answer

VPC peering requires non-overlapping CIDR blocks because the VPCs must have unique IP address spaces for routing to work correctly. Since both VPC-A and VPC-B use the same CIDR 10.0.0.0/16, the route tables cannot distinguish between the two VPCs, causing traffic to be misrouted or dropped. This is the most likely cause of the ping failure, as overlapping CIDRs prevent proper destination-based routing in the VPC peering connection.

Exam trap

The ANS-C01 exam often tests the misconception that security groups or route table entries are the primary cause of connectivity issues in VPC peering, when in fact overlapping CIDR blocks create a fundamental routing conflict that overrides all other configurations.

How to eliminate wrong answers

Option A is wrong because route tables in a VPC peering configuration do not need routes to individual private IP addresses; they need routes to the destination VPC's CIDR block, which are already updated per the scenario. Option C is wrong while security groups could block ICMP traffic, the overlapping CIDR issue is a more fundamental problem that would prevent connectivity regardless of security group rules, and the question asks for the most likely cause. Option D is wrong because the scenario explicitly states both VPCs are in the same region, and VPC peering does support cross-region peering, so this option is factually incorrect.

Practice this question →
320
Multi-Selectmedium

A company is designing a hybrid network using AWS Direct Connect and a Site-to-Site VPN as a backup. The company has two Direct Connect connections from different providers for redundancy. The company wants to use BGP to automatically fail over to the VPN if both Direct Connect connections fail. Which TWO configurations are required to achieve this?

Select 2 answers
A.Set a higher local preference on the VPN route to make it preferred over Direct Connect.
B.Configure the VPN connection with static routes instead of BGP.
C.Disable route propagation on the VPN connection's route table.
D.Adjust BGP attributes on the Direct Connect routes to be preferred over the VPN routes.
E.Use a VPN connection that supports dynamic BGP routing.
AnswersD, E

By making Direct Connect routes more preferred (e.g., higher local preference), the VPN will only be used when Direct Connect is down.

Why this answer

Setting a higher local preference on Direct Connect routes makes them more preferred over VPN routes under normal conditions. Option E is correct because dynamic BGP routing on the VPN is required to allow automatic failover and route advertisement when Direct Connect fails, enabling BGP to withdraw routes and trigger failover.

Exam trap

The ANS-C01 exam often tests the misconception that you should set a higher local preference on the backup path (VPN) to make it preferred, but the correct approach is to make the primary path (Direct Connect) more preferred so that failover occurs only when the primary is unavailable.

Practice this question →
321
MCQeasy

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which AWS service should be used to allow this access without traversing the internet?

A.Transit Gateway
B.NAT gateway
C.VPC Gateway Endpoint for S3
D.Internet gateway
AnswerC

Gateway Endpoint allows private access to S3.

Why this answer

A VPC Gateway Endpoint for S3 allows EC2 instances in a private subnet to access S3 buckets without traversing the internet by using AWS's internal network. It uses prefix lists and route table entries to direct S3 traffic through the endpoint, which is horizontally scaled and highly available. This avoids the need for a NAT gateway or internet gateway, keeping traffic within the AWS backbone.

Exam trap

The trap here is that candidates often confuse VPC Gateway Endpoints with VPC Interface Endpoints (powered by PrivateLink) or assume a NAT gateway is required for any outbound traffic, not realizing that S3 and DynamoDB support Gateway Endpoints for direct private access.

How to eliminate wrong answers

Option A is wrong because Transit Gateway is used to interconnect VPCs and on-premises networks, not to provide direct private access to AWS services like S3. Option B is wrong because a NAT gateway enables outbound internet access for private subnets, but it still routes traffic over the internet, which is unnecessary and incurs additional cost for S3 access. Option D is wrong because an internet gateway provides internet access for public subnets, but it requires the EC2 instance to have a public IP or route through a NAT device, violating the requirement to avoid traversing the internet.

Practice this question →
322
MCQmedium

A company is deploying a global application behind an Application Load Balancer (ALB) in AWS. They want to use AWS Global Accelerator to improve performance by directing traffic to the nearest healthy endpoint. Which configuration is required to achieve this?

A.Create an accelerator with an endpoint group that includes the ALB as an endpoint
B.Configure Route 53 health checks for the ALB and associate them with Global Accelerator
C.Configure a CloudFront distribution with the ALB as an origin and enable Global Accelerator
D.Create a Route 53 latency-based routing record set pointing to the ALB
AnswerA

Global Accelerator directs traffic to the nearest healthy endpoint in the endpoint group.

Why this answer

AWS Global Accelerator uses endpoint groups to direct traffic to the nearest healthy endpoint. By creating an accelerator with an endpoint group that includes the ALB as an endpoint, Global Accelerator can route user traffic over the AWS global network to the optimal ALB based on latency and health, improving performance for global users.

Exam trap

The ANS-C01 exam often tests the misconception that Route 53 latency-based routing or CloudFront can replace Global Accelerator for performance optimization, but the key differentiator is that Global Accelerator uses anycast IPs and the AWS global network for non-cached, dynamic traffic.

How to eliminate wrong answers

Option B is wrong because Route 53 health checks are not used by Global Accelerator; Global Accelerator performs its own health checks on endpoints within endpoint groups. Option C is wrong because CloudFront is a CDN that caches content at edge locations, and while it can use Global Accelerator, the question specifically requires Global Accelerator to direct traffic to the nearest healthy ALB endpoint, not to cache content. Option D is wrong because Route 53 latency-based routing directs traffic to the ALB based on DNS resolution, which does not provide the same performance benefits as Global Accelerator's anycast IP and AWS global network optimization.

Practice this question →
323
Multi-Selectmedium

A company has a VPC with public and private subnets. The public subnet has a NAT Gateway. The private subnet instances need to access an S3 bucket in the same region. Which THREE steps should the network engineer take to ensure the most cost-effective and secure access without traversing the internet?

Select 3 answers
A.Create a VPC Gateway Endpoint for S3.
B.Attach an endpoint policy that allows access to the specific S3 bucket.
C.Create a VPC Interface Endpoint for S3.
D.Update the route table for the private subnets to include a route to the S3 endpoint.
E.Create a NAT Gateway in the public subnet.
AnswersA, B, D

Gateway Endpoints are free and provide private access to S3.

Why this answer

A VPC Gateway Endpoint for S3 provides private, cost-effective access to S3 without traversing the internet or requiring a NAT Gateway. It uses AWS's internal network and route table entries to direct S3 traffic through the endpoint, avoiding data transfer costs and improving security.

Exam trap

AWS often tests the misconception that Interface Endpoints are required for all AWS services, but for S3 and DynamoDB, Gateway Endpoints are the correct, cost-effective choice, and candidates may incorrectly select Interface Endpoints due to familiarity with other services.

Practice this question →
324
MCQeasy

A company is deploying a VPC with public and private subnets. They want to allow instances in a private subnet to access the internet for software updates while preventing inbound internet traffic. Which configuration should be used?

A.Create a VPC endpoint for internet access
B.Use a transit gateway with a NAT instance
C.Attach an internet gateway to the VPC and add a route in the private subnet to the internet gateway for 0.0.0.0/0
D.Attach an internet gateway to the VPC, and create a NAT gateway in a public subnet. Add a route in the private subnet route table to the NAT gateway for 0.0.0.0/0
AnswerD

NAT gateway enables outbound internet from private subnets.

Why this answer

A NAT gateway, deployed in a public subnet with an Internet Gateway (IGW) attached, allows instances in private subnets to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while the IGW's one-way translation prevents unsolicited inbound traffic from reaching the private instances. The private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway's elastic network interface.

Exam trap

The trap here is that candidates confuse a NAT gateway's outbound-only behavior with an Internet Gateway's bidirectional routing, leading them to incorrectly select Option C, which would allow inbound traffic and violate the security requirement.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint (e.g., Gateway or Interface endpoint) provides private connectivity to specific AWS services (like S3 or DynamoDB) via the AWS network, not general internet access for arbitrary software update servers. Option B is wrong because a transit gateway is used for inter-VPC or on-premises connectivity, not for providing outbound internet access; a NAT instance (a managed EC2 instance) can work but is less reliable and scalable than a NAT gateway, and the transit gateway adds unnecessary complexity. Option C is wrong because adding a route in the private subnet to the internet gateway for 0.0.0.0/0 would directly expose private instances to inbound internet traffic, as the IGW does not perform source NAT; it would allow bidirectional traffic, violating the requirement to prevent inbound internet traffic.

Practice this question →
325
MCQeasy

A company wants to securely connect their on-premises data center to AWS using a site-to-site VPN. They have multiple branch offices that also need to connect to AWS. Which AWS service should they use to simplify the management of multiple VPN connections?

A.VPC Peering
B.AWS Direct Connect
C.AWS Transit Gateway
D.VPN CloudHub
AnswerC

Transit Gateway provides a hub-and-spoke model to connect multiple VPNs and VPCs.

Why this answer

AWS Transit Gateway (C) acts as a central hub that interconnects VPCs and on-premises networks, allowing you to manage multiple site-to-site VPN connections and branch office attachments through a single gateway. This simplifies routing and reduces operational overhead compared to managing individual VPN connections between each branch and each VPC.

Exam trap

The trap here is that candidates often confuse VPN CloudHub with Transit Gateway, but CloudHub is a simpler, older solution that lacks the centralized management, advanced routing policies, and scalability of Transit Gateway, which is the modern best practice for multi-site VPN connectivity.

How to eliminate wrong answers

Option A is wrong because VPC Peering provides direct connectivity between two VPCs only, and does not support VPN connections to on-premises data centers or branch offices. Option B is wrong because AWS Direct Connect is a dedicated physical connection for high-bandwidth, low-latency links, not a service to simplify management of multiple VPN connections; it also requires separate VPN or Transit Gateway for encryption. Option D is wrong because VPN CloudHub is a legacy AWS solution that uses a single virtual private gateway to connect multiple branch offices via VPN, but it lacks the advanced routing, scalability, and centralized management features of Transit Gateway.

Practice this question →
326
MCQmedium

A network engineer is troubleshooting connectivity issues. The route table shows a blackhole route for 10.0.0.0/8 pointing to a VPC endpoint (vpce-12345678). What is the most likely cause of the blackhole state?

A.The VPC endpoint (vpce-12345678) has been deleted.
B.The VPC CIDR 10.0.0.0/16 is overlapping with the endpoint route.
C.The route table does not have a route to the internet.
D.The internet gateway is not attached to the VPC.
AnswerA

A deleted endpoint results in a blackhole route.

Why this answer

A blackhole route in a VPC route table indicates that the target for the route (in this case, a VPC endpoint) is not in a valid state. When a VPC endpoint (vpce-12345678) is deleted, all routes pointing to it become blackhole routes because the target no longer exists. This causes traffic destined for 10.0.0.0/8 to be dropped silently.

Exam trap

The trap here is that candidates may think a blackhole route is caused by routing conflicts or missing internet connectivity, rather than recognizing that it specifically indicates the target resource (like a VPC endpoint) has been deleted or is in an invalid state.

How to eliminate wrong answers

Option B is wrong because overlapping CIDRs do not cause a blackhole state; overlapping routes are handled by longest prefix match, and the route table would still show the route as active, not blackhole. Option C is wrong because the absence of an internet route does not cause a blackhole state for a specific endpoint route; it would simply prevent internet-bound traffic, not affect the 10.0.0.0/8 route. Option D is wrong because an internet gateway not being attached does not cause a blackhole state for a VPC endpoint route; it would only affect routes targeting the internet gateway.

Practice this question →
327
MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. They notice that the BGP session is flapping every few minutes. The network team confirms that the customer router and AWS router are configured correctly. What is the MOST likely cause of the BGP flapping?

A.The BGP community string is not set correctly
B.MTU mismatch between the customer router and the AWS Direct Connect endpoint
C.Incorrect BGP ASN configuration on the virtual interface
D.Bidirectional Forwarding Detection (BFD) is not enabled
AnswerB

Packet drops cause BGP session instability.

Why this answer

B is correct because an MTU mismatch between the customer router and the AWS Direct Connect endpoint can cause BGP session flapping. When the MTU is mismatched, larger BGP keepalive or update packets may be fragmented or dropped, leading to hold timer expirations and session resets. This occurs even if both routers are configured correctly for BGP, as the issue lies at the Layer 2/3 boundary rather than the BGP configuration itself.

Exam trap

The ANS-C01 exam often tests the misconception that BGP flapping is always caused by BGP configuration errors (ASN, communities) or missing features like BFD, when in reality Layer 2/3 issues like MTU mismatch are a common root cause in Direct Connect scenarios.

How to eliminate wrong answers

Option A is wrong because BGP communities are optional transitive attributes used for route tagging and policy, not for session stability; an incorrect community string would not cause BGP session flapping. Option C is wrong because an incorrect BGP ASN on the virtual interface would prevent the BGP session from establishing at all, not cause intermittent flapping after it has come up. Option D is wrong because BFD is a fast failure detection mechanism that enhances BGP convergence but is not required for session stability; its absence does not cause flapping.

Practice this question →
328
MCQmedium

A company has a VPC with public and private subnets. They have a web server in the public subnet that needs to make API calls to Amazon S3. The web server has a public IP. What is the MOST secure way to allow the web server to access S3 without traversing the internet?

A.Create a Gateway VPC Endpoint for S3 and add a route in the public subnet's route table to S3 via the endpoint
B.Place a forward proxy server in the public subnet and configure the web server to use it for S3
C.Create an Interface VPC Endpoint for S3 in the public subnet
D.Set up a NAT Gateway in the same subnet and route S3 traffic through it
AnswerA

Correct; Gateway Endpoint provides private access to S3 without internet.

Why this answer

A Gateway VPC Endpoint for S3 allows resources within a VPC to access S3 over the AWS private network without traversing the internet. By adding a route in the public subnet's route table pointing to the endpoint, the web server can reach S3 privately, even though it has a public IP. This is the most secure option because traffic stays within the AWS backbone and does not require an internet gateway, NAT, or proxy.

Exam trap

The trap here is that candidates often confuse Gateway VPC Endpoints with Interface VPC Endpoints, assuming an interface is needed for all services, but S3 and DynamoDB exclusively use Gateway Endpoints for private connectivity without internet traversal.

How to eliminate wrong answers

Option B is wrong because a forward proxy server would still route traffic through the internet gateway, defeating the requirement to avoid internet traversal and adding unnecessary complexity and latency. Option C is wrong because an Interface VPC Endpoint for S3 is typically used for private subnets or on-premises connectivity via AWS PrivateLink; placing it in a public subnet is unnecessary and does not provide the same cost-effective, high-throughput connectivity as a Gateway Endpoint. Option D is wrong because a NAT Gateway in the same subnet would route S3 traffic through the internet gateway, which violates the requirement to avoid internet traversal and introduces additional cost and latency.

Practice this question →
329
MCQmedium

A company is troubleshooting connectivity issues between an on-premises network and a VPC connected via AWS VPN CloudHub. The on-premises network uses multiple customer gateways (CGWs) connected to a single virtual private gateway (VGW). The company wants to ensure that all traffic from the VPC to on-premises is routed through a specific CGW. Which configuration should be used?

A.Adjust the BGP local preference on the preferred CGW to a higher value
B.Remove the other CGWs from the VGW
C.Modify the VPN tunnel option to prefer the specific tunnel
D.Configure a static route in the VPC route table pointing to the VGW with a more specific prefix for the on-premises network
AnswerD

Static routes take precedence over BGP routes.

Why this answer

In an AWS VPN CloudHub setup, the VPC route table controls how traffic from the VPC is forwarded to the on-premises network via the virtual private gateway (VGW). By adding a static route with a more specific prefix (e.g., a /24 instead of a /16) for the on-premises network, you force the VPC to prefer that route over any dynamically learned routes from other CGWs, ensuring all traffic uses the designated CGW. This approach leverages the longest prefix match rule in the VPC route table, overriding BGP-learned routes without altering the BGP configuration.

Exam trap

The trap here is that candidates often confuse BGP path selection attributes (like local preference) with VPC route table behavior, assuming they can influence outbound VPC traffic from AWS, when in fact BGP attributes only affect inbound traffic direction from on-premises to AWS.

How to eliminate wrong answers

Option A is wrong because adjusting BGP local preference on the preferred CGW influences inbound traffic direction (from on-premises to AWS), not outbound traffic from the VPC to on-premises; the VPC route table does not consider BGP attributes like local preference. Option B is wrong because removing other CGWs from the VGW would disrupt connectivity to those on-premises locations, which is not a scalable or intended solution for traffic steering. Option C is wrong because modifying the VPN tunnel option (e.g., tunnel preference) affects which tunnel within a single VPN connection is used, not which CGW or VPN connection is selected for traffic from the VPC.

Practice this question →
330
MCQmedium

A company is setting up a new VPC with a CIDR block of 10.0.0.0/16. They need to create subnets for different tiers: public (web servers), private (application servers), and database (RDS). They want to maximize the number of available IP addresses while ensuring each subnet has at least 256 IP addresses. Which subnet design meets these requirements?

A.Create six /24 subnets (256 IPs each) across two Availability Zones (three per AZ).
B.Create three /25 subnets (128 IPs each) in one Availability Zone.
C.Create six /26 subnets (64 IPs each) across two Availability Zones.
D.Create three /24 subnets (256 IPs each) in one Availability Zone.
AnswerA

/24 provides 256 IPs, and using two AZs provides high availability.

Why this answer

It creates six /24 subnets (each with 256 IP addresses) across two Availability Zones, meeting the requirement of at least 256 IPs per subnet while maximizing total available IPs (1,536 IPs) and providing high availability by distributing subnets across multiple AZs. The /24 subnet mask provides exactly 256 IPs (254 usable) per subnet, which satisfies the minimum requirement without wasting address space.

Exam trap

The trap here is that candidates focus solely on the IP count requirement (at least 256 IPs) and overlook the high-availability requirement implied by 'maximize the number of available IP addresses' and best practices, leading them to choose Option D (three /24 subnets in one AZ) instead of the correct multi-AZ design.

How to eliminate wrong answers

Option B is wrong because /25 subnets provide only 128 IPs (126 usable) per subnet, which does not meet the requirement of at least 256 IP addresses. Option C is wrong because /26 subnets provide only 64 IPs (62 usable) per subnet, far below the 256 IP minimum requirement. Option D is wrong because while it creates three /24 subnets with 256 IPs each, it places all subnets in a single Availability Zone, which violates best practices for high availability and fault tolerance; the requirement to 'maximize the number of available IP addresses' is also not met compared to six subnets.

Practice this question →
331
Multi-Selecthard

Which THREE of the following are valid considerations when designing a multi-VPC architecture using AWS Transit Gateway? (Choose three.)

Select 3 answers
A.You can route internet-bound traffic from multiple VPCs through a single shared VPC with a NAT gateway.
B.Transit Gateway does not support multicast traffic.
C.You can use separate route tables to isolate traffic between different VPCs.
D.VPCs attached to the same Transit Gateway can have overlapping CIDR blocks.
E.You can attach a Direct Connect Gateway to a Transit Gateway for hybrid connectivity.
AnswersA, C, E

Centralized NAT via Transit Gateway routing.

Why this answer

AWS Transit Gateway allows you to centralize internet-bound traffic by routing it from multiple VPCs through a single shared VPC that contains a NAT gateway. This design reduces costs and simplifies management by avoiding the need for a separate NAT gateway in each VPC, as the Transit Gateway can propagate routes to direct traffic to the shared VPC's NAT gateway for egress to the internet.

Exam trap

The ANS-C01 exam often tests the misconception that Transit Gateway does not support multicast at all, when in fact it does support it with specific configuration requirements, and the trap with overlapping CIDRs is that candidates assume route tables can resolve conflicts, but Transit Gateway requires unique CIDRs across all attached VPCs for proper routing.

Practice this question →
332
MCQhard

A company has multiple VPCs connected via a transit gateway. Each VPC has a security group that allows traffic from the other VPCs' CIDR blocks. The security group rules are getting complex. How can the company simplify security group management while maintaining the same level of security?

A.Use managed prefix lists in security group rules.
B.Use VPC endpoints for inter-VPC communication.
C.Deploy AWS Network Firewall to centralize rules.
D.Replace security groups with network ACLs.
AnswerA

Prefix lists simplify by grouping CIDRs.

Why this answer

Use managed prefix lists. Prefix lists allow you to group CIDR blocks and reference them in security group rules, simplifying management. Option B is wrong because VPC endpoints are for accessing AWS services privately, not for inter-VPC communication.

Option C is wrong because AWS Network Firewall adds another layer of complexity and cost; prefix lists achieve simplification more directly. Option D is wrong because network ACLs are stateless and less granular than security groups, and they cannot use prefix lists for rule simplification.

Practice this question →
333
MCQeasy

A company has a VPC with a public subnet hosting a web server. They want to make the web server accessible over the internet. The web server has a public IP address. The public subnet route table has a default route (0.0.0.0/0) to an internet gateway. The security group for the web server allows inbound HTTP (port 80) from 0.0.0.0/0. However, external users cannot access the web server. What is the most likely cause?

A.The internet gateway is not attached to the VPC
B.The web server is not listening on port 80
C.The route table for the public subnet does not have a route to the internet gateway
D.The network ACL for the public subnet is blocking inbound HTTP traffic
AnswerA

Internet gateway must be attached for public traffic.

Why this answer

The internet gateway must be attached to the VPC. If it is not attached, traffic cannot flow. Option B (NACL) could be blocking but default NACL allows all traffic.

Option C (web server not listening) is possible but less likely than IGW attachment. Option D (route table) is already correct.

Practice this question →
334
MCQmedium

A company uses AWS Global Accelerator to improve performance for a web application hosted on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The Global Accelerator has an endpoint group in the us-east-1 Region with the ALB as an endpoint. Users in Asia report high latency. The company creates a new endpoint group in ap-southeast-1 and adds the same ALB (which is still in us-east-1). However, users in Asia still experience high latency. What should the network engineer do to reduce latency for Asian users?

A.Change the endpoint in ap-southeast-1 to use the same ALB but with a cross-Region VPC peering
B.Configure Global Accelerator to use weighted routing to direct more traffic to ap-southeast-1
C.Add an additional ALB in ap-southeast-1 and add it as an endpoint in the ap-southeast-1 endpoint group
D.Use Lambda@Edge to cache content at CloudFront edge locations in Asia
AnswerC

Deploying locally reduces latency.

Why this answer

Global Accelerator routes traffic to the nearest endpoint group based on latency. However, if the endpoint (ALB) is only in us-east-1, traffic from Asia will still be forwarded to us-east-1 after reaching the ap-southeast-1 endpoint group because the endpoint itself is in us-east-1. To reduce latency, the company must deploy the application in ap-southeast-1 and add a local ALB as an endpoint in the ap-southeast-1 endpoint group.

Option C correctly describes this. Option A is incorrect because the ALB cannot be in us-east-1 and serve as an endpoint for ap-southeast-1; endpoint group and endpoint must be in the same Region. Option B is incorrect because weighted routing does not change the physical location of the endpoint; the ALB is still distant.

Option D uses CloudFront, which is a CDN, not a Global Accelerator solution, and does not reduce latency for the Global Accelerator use case.

Exam trap

The trap is that the endpoint group with a different endpoint region cannot leverage the regional proximity; you must deploy the application locally.

Practice this question →
335
MCQeasy

A company needs to establish a dedicated, low-latency, and consistent network connection from their on-premises data center to AWS. Which AWS service should they use?

A.AWS Site-to-Site VPN
B.AWS VPN CloudHub
C.VPC peering
D.AWS Direct Connect
AnswerD

Direct Connect provides a dedicated, private, low-latency connection.

Why this answer

AWS Direct Connect provides a dedicated, low-latency, and consistent private network connection from on-premises to AWS, bypassing the internet. Option A (Site-to-Site VPN) uses the public internet and is less consistent. Option B (VPN CloudHub) connects multiple on-premises sites to AWS but still relies on the internet.

Option C (VPC peering) connects VPCs within AWS, not on-premises. Therefore, D is correct.

Practice this question →
336
MCQhard

A company uses AWS Client VPN for remote access. Users report intermittent disconnections. The network engineer notices that the Client VPN endpoint is associated with a single subnet. What change should be made to improve reliability?

A.Split the client CIDR into smaller ranges for each Availability Zone.
B.Associate the Client VPN endpoint with subnets in at least two Availability Zones.
C.Create multiple route tables for the same subnet.
D.Increase the subnet CIDR size to accommodate more clients.
AnswerB

Provides redundancy if one AZ fails.

Why this answer

Associating the Client VPN endpoint with subnets in at least two Availability Zones provides high availability for the VPN tunnel endpoints. If a single subnet (and its underlying AZ) fails or experiences network issues, the Client VPN endpoint can still route traffic through the other AZ's subnet, preventing the intermittent disconnections users are experiencing.

Exam trap

The trap here is that candidates often confuse scaling (increasing CIDR or route tables) with high availability, failing to recognize that a single subnet creates a single point of failure for the entire Client VPN endpoint.

How to eliminate wrong answers

Option A is wrong because splitting the client CIDR into smaller ranges per AZ does not address the single point of failure; the Client VPN endpoint itself remains tied to one subnet, and client CIDR allocation is unrelated to endpoint resilience. Option C is wrong because creating multiple route tables for the same subnet does not add redundancy; route tables control traffic forwarding within a VPC, not the availability of the VPN endpoint. Option D is wrong because increasing the subnet CIDR size only allows more concurrent client connections, but does not mitigate the risk of a single Availability Zone failure causing disconnections.

Practice this question →
337
Multi-Selectmedium

A network engineer is designing a hybrid network architecture that connects an on-premises data center to AWS using AWS Direct Connect and a VPN connection as a backup. The on-premises network uses BGP to advertise routes to AWS. Which of the following are best practices for this setup? (Choose TWO.)

Select 2 answers
A.Advertise the same routes over both connections with identical BGP attributes.
B.Use different BGP ASNs for the Direct Connect and VPN connections.
C.Use the VPN connection as the primary path and Direct Connect as the backup.
D.Use the same BGP ASN for both the Direct Connect and VPN connections.
E.Configure BGP attributes to ensure that the Direct Connect path is preferred over the VPN path.
AnswersB, E

Different ASNs prevent routing loops and allow proper path selection.

Why this answer

Using different BGP ASNs for the Direct Connect and VPN connections prevents BGP from treating the two connections as a single eBGP session, which would cause routing loops or suboptimal path selection. This separation allows AWS to distinguish between the two paths and apply independent routing policies. Option E is correct because configuring BGP attributes (such as AS path prepending or MED) on the Direct Connect path ensures it is preferred over the VPN backup, aligning with the design goal of using Direct Connect as the primary link.

Exam trap

The trap here is that candidates often think using the same BGP ASN simplifies configuration, but in a dual-connection design, it actually breaks path independence and can cause routing instability or suboptimal failover behavior.

Practice this question →
338
MCQeasy

A company is deploying a hybrid network architecture with an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The on-premises network uses BGP to advertise routes to the VPN connection. After the VPN is established, the on-premises network cannot reach EC2 instances in the VPC. The VPC route table has a route for the on-premises CIDR block pointing to the VPN gateway. What is the most likely cause of this issue?

A.The VPN connection is not using the correct pre-shared key.
B.The security group attached to the EC2 instances does not allow inbound traffic from the on-premises CIDR.
C.The on-premises network is advertising a default route (0.0.0.0/0) via BGP, which is overriding the VPC's local route.
D.The VPC's network ACLs are blocking inbound traffic from the on-premises network.
AnswerC

BGP route propagation can cause the VPC route table to learn a default route from on-premises, which may cause traffic destined for the VPC CIDR to be sent back to the VPN gateway instead of staying local.

Why this answer

When the on-premises network advertises a default route (0.0.0.0/0) via BGP over the VPN connection, the VPC propagates that route into its route tables (if route propagation is enabled). This default route can override the VPC's local route for the on-premises CIDR, causing traffic destined for the on-premises network to be sent back out the VPN gateway instead of being delivered locally, effectively breaking connectivity to EC2 instances.

Exam trap

The trap here is that candidates often focus on security group or NACL misconfigurations, but the real issue is a routing conflict caused by BGP advertising a default route that overrides the VPC's local route, a classic hybrid networking pitfall.

How to eliminate wrong answers

Option A is wrong because an incorrect pre-shared key would prevent the VPN tunnel from establishing at all, but the question states the VPN is established. Option B is wrong because security groups are stateful and, by default, allow all outbound traffic; the issue is about inbound traffic not reaching the instances, but the root cause is a routing problem, not a firewall rule. Option D is wrong because network ACLs are stateless and, by default, allow all inbound and outbound traffic unless explicitly modified; the question does not indicate any custom NACL changes, so they are not blocking traffic.

Practice this question →
339
MCQmedium

A company has a VPC with two subnets: a public subnet with a NAT Gateway and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance has a security group that allows all outbound traffic. The private subnet's route table has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instance cannot reach the internet. What is the most likely issue?

A.The security group does not allow inbound traffic from the internet.
B.The NAT Gateway is deployed in a private subnet.
C.The network ACL on the private subnet blocks outbound traffic.
D.The instance's DNS resolution is not configured correctly.
AnswerB

NAT Gateway requires a public subnet with an Internet Gateway to function.

Why this answer

The NAT Gateway must be deployed in a public subnet with an Internet Gateway (IGW) attached to its route table to translate private IP addresses to the IGW's public IP. If the NAT Gateway is in a private subnet, it has no route to the internet, so traffic from the private EC2 instance reaches the NAT Gateway but cannot be forwarded to the internet. This is the most likely issue because the route table correctly points to the NAT Gateway, but the gateway itself lacks internet connectivity.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT Gateway can be placed in any subnet as long as the private subnet's route table points to it, but the trap is that the NAT Gateway must be in a public subnet with an IGW route to function.

How to eliminate wrong answers

Option A is wrong because the security group allows all outbound traffic, and outbound traffic from the instance to the internet does not require inbound rules from the internet; security groups are stateful, so return traffic is automatically allowed. Option C is wrong because the question states the private subnet's route table has a default route to the NAT Gateway, and network ACLs are stateless, but the issue is not about ACLs blocking traffic—the problem is the NAT Gateway's placement, not ACL rules. Option D is wrong because DNS resolution is not required for reaching the internet via a NAT Gateway; the instance can use IP addresses directly, and DNS configuration would not prevent connectivity if the NAT Gateway is misconfigured.

Practice this question →
340
MCQmedium

A company is setting up a Direct Connect connection to AWS. The on-premises router is configured with a BGP ASN of 64511. The AWS side uses a public ASN of 64512. Which configuration change is required for BGP peering to establish?

A.Increase the eBGP multihop TTL to 2.
B.Configure the BGP peer with a public ASN on the customer side.
C.Enable BGP authentication with MD5 password.
D.Change the customer ASN to a value in the 64512-65534 range.
AnswerD

Direct Connect requires private ASNs for the customer side.

Why this answer

The customer's BGP ASN 64511 is not within the private ASN range 64512-65534 required by AWS Direct Connect. Therefore, the customer must change their ASN to a value in that range to establish BGP peering.

Exam trap

The trap here is that candidates assume any ASN is acceptable for BGP peering, but AWS Direct Connect specifically requires the customer ASN to be in the private range 64512–65534 unless a special request is made to use a public ASN.

How to eliminate wrong answers

Option A is wrong because eBGP multihop TTL is not relevant for Direct Connect; the BGP peers are directly connected over the VLAN, so the default TTL of 1 is sufficient. Option B is wrong because AWS does not require the customer to use a public ASN; in fact, AWS recommends using a private ASN from the 64512–65534 range for the customer side. Option C is wrong because BGP authentication with MD5 is optional and not required for BGP peering to establish; it is a security feature, not a prerequisite.

Practice this question →
341
MCQeasy

A company is setting up AWS Client VPN to allow remote employees to access resources in a VPC. The VPC has a CIDR block of 10.0.0.0/16. The Client VPN endpoint is associated with a subnet 10.0.1.0/24. The company wants to assign client IP addresses from a different CIDR range than the VPC to avoid overlap. Which client CIDR range should the company specify?

A.172.16.0.0/12
B.10.0.0.0/16
C.10.0.0.0/8
D.192.168.0.0/16
AnswerA, D

172.16.0.0/12 is a private RFC 1918 range that does not overlap with the VPC CIDR (10.0.0.0/16). It is a valid client CIDR range.

Why this answer

The client CIDR range must not overlap with the VPC CIDR (10.0.0.0/16) or any on-premises networks. Both 172.16.0.0/12 (A) and 192.168.0.0/16 (D) are private RFC 1918 ranges that do not overlap, making them valid choices. Options B and C overlap with the VPC CIDR and are invalid.

Note: This question accepts multiple correct answers (multi-select).

Exam trap

Candidates may mistakenly assume only one specific private range is allowed, but any non-overlapping RFC 1918 range works. The trap is focusing on size rather than the overlap condition.

How to eliminate wrong answers

Option A is wrong because 172.16.0.0/12 is a valid private range but is not the only correct answer; more importantly, the question asks for a specific client CIDR, and 172.16.0.0/12 is a large range that could overlap with other networks, but the primary reason it is not the best answer is that it is not explicitly required to be a /16 as per the correct answer. Option B is wrong because 10.0.0.0/16 directly overlaps with the VPC CIDR (10.0.0.0/16), which would cause routing conflicts and is explicitly prohibited by AWS Client VPN design. Option C is wrong because 10.0.0.0/8 is a superset of the VPC CIDR and would also overlap, leading to the same routing issues; AWS requires the client CIDR to be distinct from the VPC CIDR.

Practice this question →
342
MCQmedium

A company is setting up an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The VPC has a virtual private gateway (VGW) attached, and the VPN connection uses two tunnels for redundancy. The on-premises customer gateway (CGW) is configured with the public IP address of the on-premises VPN device. The VPN tunnels are up and BGP sessions are established. However, the company cannot ping an EC2 instance in the VPC from an on-premises server. The security group for the EC2 instance allows ICMP from the on-premises network CIDR. What is the MOST likely cause of the issue?

A.The route tables of the VPC subnets do not have a route for the on-premises CIDR pointing to the virtual private gateway.
B.The customer gateway is configured with an incorrect private IP address.
C.The VPN connection's security group is blocking ICMP traffic.
D.The BGP session is not advertising the on-premises routes to the VGW.
AnswerA

Without a route, traffic from VPC to on-premises is dropped.

Why this answer

The VPC subnet route tables must have a route pointing to the VGW for the on-premises CIDR. Option B is incorrect because BGP is established. Option C is incorrect because the CGW is configured correctly.

Option D is incorrect because the VPN connection does not have a security group.

Practice this question →
343
Multi-Selecthard

A company is using AWS Direct Connect with a private VIF to connect its on-premises network to a VPC. The VPC has a CIDR 10.0.0.0/16. The on-premises network uses 192.168.0.0/16. The company wants to enable communication between on-premises and the VPC, and also allow the VPC to access the internet via an internet gateway. Which TWO of the following configurations are necessary?

Select 2 answers
A.A route in the on-premises router for the VPC CIDR (10.0.0.0/16) pointing to the AWS Direct Connect router.
B.A route in the VPC route table for 0.0.0.0/0 pointing to the internet gateway.
C.A route in the VPC route table for 0.0.0.0/0 pointing to the virtual private gateway.
D.A route in the VPC route table for the on-premises CIDR (192.168.0.0/16) pointing to the internet gateway.
E.A route in the VPC route table for the on-premises CIDR (192.168.0.0/16) pointing to the virtual private gateway.
AnswersB, E

Required for VPC internet access.

Why this answer

An internet gateway (IGW) provides internet access for a VPC, and the VPC's main route table must include a default route (0.0.0.0/0) pointing to the IGW for outbound internet traffic. This allows instances in the VPC to reach the internet, which is a stated requirement. Without this route, traffic destined for the internet would have no path.

Exam trap

The ANS-C01 exam often tests the misconception that a default route (0.0.0.0/0) should point to the virtual private gateway when using Direct Connect, but the correct configuration for internet access is to point it to the internet gateway, while the on-premises CIDR route points to the VGW.

Practice this question →
344
MCQmedium

A company is implementing a network for a three-tier application in a VPC. They need to ensure that the web tier can communicate with the application tier, but the application tier cannot initiate connections to the web tier. Which configuration should be used?

A.Use network ACLs on the application tier subnets to allow inbound from web tier and block outbound to web tier
B.Use a transit gateway with route tables to control traffic flow
C.Place a reverse proxy between the tiers
D.Use security groups on the application tier instances to allow inbound from the web tier security group, and do not allow inbound from application tier in the web tier security group
AnswerD

Stateful security groups allow responses and block unwanted initiation.

Why this answer

Security groups are stateful and can be configured to allow inbound traffic from the web tier security group to the application tier instances, while the web tier security group only allows inbound from the application tier's security group on specific ports (if needed) and does not allow inbound from the application tier. This prevents the application tier from initiating connections to the web tier. Option A is wrong because network ACLs are stateless and would require explicit inbound and outbound rules to control the direction, but they do not track connection state and are more complex to configure for this requirement.

Option B is wrong because a transit gateway is used for connecting multiple VPCs or on-premises networks, not for controlling traffic direction between tiers within the same VPC. Option C is wrong because a reverse proxy is used to forward requests from clients to servers, not to restrict initiation of connections.

Practice this question →
345
MCQhard

A company has a VPC with a CIDR block of 10.0.0.0/16. The VPC has three subnets: 10.0.1.0/24, 10.0.2.0/24, and 10.0.3.0/24. An EC2 instance in subnet 10.0.1.0/24 needs to send traffic to an on-premises server at 10.0.0.5/32 via a VPN connection. The VPC route table has a route to the VPN gateway for 10.0.0.0/8. What is the expected behavior?

A.Traffic to 10.0.0.5 is sent to the internet gateway.
B.Traffic to 10.0.0.5 is routed through the VPN gateway.
C.Traffic to 10.0.0.5 stays within the VPC.
D.Traffic to 10.0.0.5 is dropped because there is no matching route.
AnswerC

The VPC's local route matches 10.0.0.5.

Why this answer

The VPC's CIDR is 10.0.0.0/16, and the destination 10.0.0.5/32 falls within this range. AWS VPCs use the most specific route that matches the destination IP, and the local route (10.0.0.0/16) is automatically added to all VPC route tables. Since 10.0.0.5/32 is a subset of 10.0.0.0/16, the local route takes precedence over the VPN route (10.0.0.0/8) because it is more specific (longer prefix length).

Therefore, traffic destined to 10.0.0.5 stays within the VPC and is not sent to the VPN gateway.

Exam trap

The ANS-C01 exam often tests the misconception that a route to a larger CIDR (like 10.0.0.0/8) will override a more specific local route (like 10.0.0.0/16), but AWS always uses the longest prefix match, so the local route takes precedence.

How to eliminate wrong answers

Option A is wrong because the route table does not have a route to an internet gateway for 10.0.0.5, and the destination is a private IP within the VPC CIDR, so traffic is not sent to the internet gateway. Option B is wrong because although there is a VPN route for 10.0.0.0/8, the local route for 10.0.0.0/16 is more specific (longer prefix length), so the VPN route is not used for destinations within the VPC CIDR. Option D is wrong because there is a matching route: the local route for 10.0.0.0/16, which covers the destination 10.0.0.5/32, so traffic is not dropped.

Practice this question →
346
MCQeasy

A network engineer is troubleshooting connectivity from an EC2 instance in a private subnet to an S3 bucket. The VPC has a VPC endpoint for S3 configured. The instance can access the internet via a NAT Gateway. Which configuration is MOST likely causing the connection to S3 to fail?

A.The S3 VPC endpoint is in a different Availability Zone than the instance.
B.The route table for the private subnet is missing a route to the S3 VPC endpoint.
C.The S3 bucket policy does not allow access from the VPC endpoint.
D.The EC2 instance does not have a public IP address.
AnswerB

Without a route to the endpoint, traffic goes via NAT Gateway, which may be blocked.

Why this answer

For an EC2 instance in a private subnet to use a VPC endpoint for S3, the subnet's route table must include a route with the S3 endpoint's prefix list as the destination and the VPC endpoint ID as the target. Without this route, traffic destined for S3 will be sent to the NAT Gateway instead, which may fail if the instance lacks a public IP or if the NAT Gateway's route table or security groups block the traffic. Option B correctly identifies this missing route as the most likely cause.

Exam trap

The ANS-C01 exam often tests the misconception that a VPC endpoint automatically routes traffic without a route table entry, leading candidates to overlook the required route and instead blame the bucket policy or the instance's public IP.

How to eliminate wrong answers

Option A is wrong because VPC endpoints for S3 are horizontally scaled and redundant across all Availability Zones in the region; they are not tied to a single AZ, so the instance's AZ does not affect connectivity. Option C is wrong because while an S3 bucket policy can restrict access, the question states the VPC endpoint is configured, and the most common cause of failure is a missing route, not a policy issue—unless explicitly stated, the default bucket policy allows access from the endpoint. Option D is wrong because the instance is in a private subnet and uses a NAT Gateway for internet access; a public IP is not required for outbound traffic via a NAT Gateway, and the VPC endpoint for S3 does not require a public IP at all.

Practice this question →
347
MCQmedium

A company has deployed a web application across multiple AWS Regions using Application Load Balancers (ALBs) and EC2 instances. They want to use AWS Global Accelerator to improve performance and provide a fixed entry point. The Global Accelerator is configured with endpoints pointing to the ALBs. However, users are experiencing intermittent failures. What is the most likely cause?

A.Client IP address preservation is enabled on the Global Accelerator for cross-Region endpoints.
B.Global Accelerator does not support multiple endpoints in different Regions.
C.The ALBs are not configured with health checks.
D.The Global Accelerator is not configured for IPv6 traffic.
AnswerA

When using cross-region endpoints, client IP address preservation must be disabled, otherwise traffic fails.

Why this answer

When client IP address preservation is enabled on Global Accelerator for cross-Region endpoints, the accelerator preserves the original client IP address in the packets sent to the Application Load Balancers. However, ALBs are layer-7 load balancers that require traffic to originate from the Global Accelerator's static IP addresses, not the client's IP, for proper routing and health check responses. This mismatch causes the ALBs to reject or mishandle traffic, leading to intermittent failures.

Exam trap

AWS often tests the misconception that client IP preservation is always beneficial, but the trap here is that enabling it for ALB endpoints in cross-Region setups breaks the expected traffic flow because ALBs require the source IP to be the Global Accelerator's IPs, not the client's.

How to eliminate wrong answers

Option B is wrong because Global Accelerator explicitly supports multiple endpoints in different Regions, allowing traffic to be routed to the closest healthy endpoint. Option C is wrong because health checks are configured on the Global Accelerator itself, not on the ALBs; ALBs have their own health checks, but the absence of ALB health checks would not cause intermittent failures from Global Accelerator. Option D is wrong because Global Accelerator supports both IPv4 and IPv6 traffic, and the question does not indicate any IPv6-related issue; the failure is unrelated to IP version support.

Practice this question →
348
MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16. The VPC has a public subnet 10.0.1.0/24 and a private subnet 10.0.2.0/24. An EC2 instance in the private subnet needs to download patches from the internet. Which configuration is required to provide outbound internet access to the private instance while preventing inbound internet traffic?

A.Attach an Internet Gateway to the private subnet and add a default route to the Internet Gateway in the private route table
B.Assign an Elastic IP to the private instance and update the security group to allow outbound traffic
C.Add an Internet Gateway to the VPC and create a route in the private subnet to 0.0.0.0/0 via the Internet Gateway
D.Deploy a NAT Gateway in the public subnet and add a default route in the private subnet route table pointing to the NAT Gateway
AnswerD

NAT Gateway enables outbound-only internet access for private instances.

Why this answer

A NAT Gateway, deployed in a public subnet with an Internet Gateway, allows instances in a private subnet to initiate outbound traffic to the internet (e.g., to download patches) while preventing any unsolicited inbound traffic from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway ID. This design ensures the private instance's traffic is source-NATed to the NAT Gateway's Elastic IP, and the Internet Gateway only accepts responses to established outbound connections.

Exam trap

The ANS-C01 exam often tests the misconception that an Internet Gateway can be used in a private subnet route table to provide outbound-only access, but the trap here is that an Internet Gateway is a symmetric gateway that allows inbound traffic unless explicitly blocked by a network ACL, which still does not prevent direct inbound connections to the instance's private IP.

How to eliminate wrong answers

Option A is wrong because an Internet Gateway cannot be attached directly to a subnet; it is attached to the VPC, and a private subnet with a default route to an Internet Gateway would expose the instance to inbound internet traffic, violating the requirement to prevent inbound traffic. Option B is wrong because assigning an Elastic IP to a private instance and allowing outbound traffic in the security group still makes the instance directly reachable from the internet (since the Elastic IP is public), and a private subnet lacks a direct route to an Internet Gateway, so outbound traffic would fail. Option C is wrong because adding a default route to the Internet Gateway in the private subnet route table would allow inbound traffic from the internet to reach the private instance (since the Internet Gateway is a two-way gateway), which does not prevent inbound internet traffic.

Practice this question →
349
Multi-Selecthard

A company is configuring a site-to-site VPN connection between its on-premises network and AWS. The VPN tunnel is up, but traffic is not passing. The company has verified that routes are correct on both sides. Which TWO actions should the company take to troubleshoot the issue?

Select 2 answers
A.Verify that the virtual private gateway is attached to the VPC.
B.Ensure that the on-premises firewall is configured to allow IPSec traffic.
C.Check the security group rules for the EC2 instances in the VPC.
D.Verify that the VPN tunnel is using the correct encryption algorithm.
E.Check the network ACLs for the subnets.
AnswersC, E

Security groups can block traffic.

Why this answer

Security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level. Even if the VPN tunnel is up and routes are correct, the security group rules must allow the desired traffic (e.g., from the on-premises network CIDR) to reach the EC2 instances. Without proper inbound rules, traffic will be dropped at the instance level, preventing communication.

Exam trap

The ANS-C01 exam often tests the distinction between security groups (stateful, instance-level) and network ACLs (stateless, subnet-level), and candidates may overlook that both must be correctly configured for traffic to pass, especially when the VPN tunnel itself is operational.

Practice this question →
350
MCQeasy

A network engineer is designing a hybrid network using AWS Direct Connect. The company requires high availability and wants to use a single AWS Direct Connect location with two connections from different customer routers. Which solution meets the high availability requirement?

A.Use a single AWS Direct Connect connection with multiple VLANs
B.Use a single AWS Direct Connect connection with two BGP sessions
C.Use two AWS Direct Connect connections from the same location, each connected to a different customer router, and configure BGP sessions over both connections
D.Use a single AWS Direct Connect connection with Bidirectional Forwarding Detection (BFD) enabled
AnswerC

Two connections from different routers provide router-level redundancy.

Why this answer

It provides two physically separate AWS Direct Connect connections from the same location, each terminating on a different customer router. This architecture eliminates single points of failure at both the connection and router level. By configuring BGP sessions over both connections, the network can use BGP path selection and failover mechanisms (e.g., AS_PATH prepending or MED) to achieve high availability.

This design meets the requirement for a single location while ensuring redundancy against a router or connection failure.

Exam trap

The ANS-C01 exam often tests the misconception that multiple VLANs or BGP sessions on a single physical connection provide high availability, but the trap here is that true redundancy requires separate physical paths and devices, not just logical separation or faster detection protocols like BFD.

How to eliminate wrong answers

Option A is wrong because a single AWS Direct Connect connection with multiple VLANs provides logical separation (e.g., for different VPCs or services) but does not offer physical redundancy; a single cable or port failure takes down all VLANs. Option B is wrong because a single AWS Direct Connect connection with two BGP sessions still relies on a single physical link; both BGP sessions would fail if the connection or the customer router fails. Option D is wrong because enabling BFD on a single connection only speeds up failure detection (sub-second convergence) but does not provide any physical or path redundancy; it cannot recover from a complete link or device outage.

Practice this question →
351
Multi-Selecthard

A network engineer is designing a highly available VPN connectivity between an on-premises data center and AWS. The company has two AWS Direct Connect connections terminated on two different AWS Direct Connect locations for redundancy. The company wants to use AWS Site-to-Site VPN as a backup for Direct Connect. The VPN connections will terminate on a single Virtual Private Gateway (VGW) attached to a VPC. The on-premises network has two customer gateways (CGWs) each with a unique BGP ASN. Which TWO actions should the engineer take to ensure automatic failover and load balancing? (Choose two.)

Select 2 answers
A.Configure the VPN connections to use BGP dynamic routing.
B.Set up a CloudWatch alarm to trigger an AWS Lambda function that changes route table entries upon VPN failure.
C.Configure the VPN connections to use static routes with equal cost multipath (ECMP).
D.Use a single customer gateway with two separate tunnels to the virtual private gateway.
E.Create two VPN connections, each from a different customer gateway to the same virtual private gateway.
AnswersA, E

BGP allows automatic route propagation and failover.

Why this answer

Using BGP dynamic routing for the VPN connections allows automatic failover and load balancing. BGP enables the VPN connections to advertise routes dynamically, and with two VPN connections from different CGWs to the same VGW, BGP can perform active/active load balancing by establishing multiple BGP sessions. If one Direct Connect or VPN connection fails, BGP withdraws the routes, and traffic automatically shifts to the remaining active paths without manual intervention.

Exam trap

The trap here is that candidates often think a single customer gateway with two tunnels provides sufficient redundancy, but the question requires two separate customer gateways (each with a unique BGP ASN) to match the two Direct Connect locations and achieve true path diversity and automatic failover.

Practice this question →
352
MCQmedium

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but in different Availability Zones. The instances are in the same security group and have proper rules. Which configuration is most likely causing the latency?

A.The instances are using jumbo frames.
B.The instances are in a cluster placement group.
C.The instances have Enhanced Networking enabled.
D.The instances are in different Availability Zones.
AnswerD

Inter-AZ traffic has higher latency.

Why this answer

The primary cause of higher latency between EC2 instances in different Availability Zones is the physical distance and the additional network hops required to traverse the AZ boundary. Even within the same VPC, traffic between AZs must pass through AWS's regional network infrastructure, which introduces a baseline latency of 1-2 milliseconds, whereas instances in the same AZ can communicate with sub-millisecond latency. The question explicitly states the instances are in different AZs, making this the most likely source of the latency issue.

Exam trap

The trap here is that candidates often assume all instances in the same VPC have identical latency regardless of AZ placement, overlooking the fundamental physical and network architecture differences between intra-AZ and inter-AZ communication.

How to eliminate wrong answers

Option A is wrong because jumbo frames (MTU 9001) reduce latency by enabling larger payloads per packet, decreasing overhead and improving throughput; they do not cause high latency. Option B is wrong because a cluster placement group is designed to provide the lowest possible latency and maximum packet-per-second performance by placing instances in a single AZ, so using it would reduce, not cause, latency. Option C is wrong because Enhanced Networking (using SR-IOV or ENA) provides higher bandwidth, lower jitter, and lower per-packet latency; it is a performance optimization, not a source of latency.

Practice this question →
353
MCQhard

A network engineer is troubleshooting connectivity issues between two VPCs connected via a VPC peering connection. The VPCs are in different AWS accounts and regions. The engineer can ping the private IP of an instance in the peered VPC from one side, but not from the other. What is the most likely cause?

A.Route tables in one VPC do not have a route to the peered VPC CIDR
B.The security group in the peered VPC is blocking ICMP traffic
C.The VPC CIDR blocks overlap
D.The VPC peering connection is in a 'pending-acceptance' state
AnswerA

A missing route in one VPC prevents return traffic, causing one-way connectivity.

Why this answer

The most likely cause is that the route tables in one VPC lack a route pointing to the peered VPC's CIDR block. For a VPC peering connection to function bidirectionally, each VPC must have a route in its route table that directs traffic destined for the other VPC's CIDR to the peering connection (pcx-*). Without this route, packets from the source VPC to the peered VPC will be dropped, even if the peering connection itself is active and the security groups allow traffic.

Exam trap

The ANS-C01 exam often tests the misconception that security groups or network ACLs are the primary cause of one-way connectivity issues, but the real trap is that route table misconfiguration is the most common reason for asymmetric traffic flow in VPC peering scenarios.

How to eliminate wrong answers

Option B is wrong because the security group in the peered VPC would block traffic from both directions equally; since the engineer can ping from one side, the security group is not the issue. Option C is wrong because overlapping CIDR blocks would prevent the VPC peering connection from being established or cause asymmetric routing, but the question states the connection exists and one direction works, so overlap is not the cause. Option D is wrong because a 'pending-acceptance' state would mean the peering connection is not yet active, so no traffic would flow in either direction, contradicting the fact that one side can ping successfully.

Practice this question →
354
MCQeasy

A company wants to allow an EC2 instance in a private subnet to download files from an S3 bucket without traversing the internet. Which AWS service should be used?

A.Establish an AWS Direct Connect connection to the VPC.
B.Attach an internet gateway and route through a NAT gateway.
C.Create a VPC Interface Endpoint for S3.
D.Create a VPC Gateway Endpoint for S3.
AnswerD

Gateway Endpoint provides private connectivity to S3 without internet.

Why this answer

A VPC Gateway Endpoint for S3 allows instances in a private subnet to access S3 without traversing the internet by routing traffic through AWS's internal network. It uses prefix lists and route table entries to direct S3 traffic to the endpoint, avoiding the need for NAT gateways or internet gateways.

Exam trap

The ANS-C01 exam often tests the distinction between Gateway Endpoints and Interface Endpoints, where candidates mistakenly choose Interface Endpoint for S3 because they confuse it with services like DynamoDB or API Gateway, or assume all AWS services use the same endpoint type.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not a solution for EC2-to-S3 access within the same region; it would still require a gateway endpoint or interface endpoint for private subnet access. Option B is wrong because attaching an internet gateway and routing through a NAT gateway forces traffic to traverse the internet, violating the requirement to avoid internet traversal; this also incurs NAT gateway costs and adds latency. Option C is wrong because a VPC Interface Endpoint for S3 is not supported; S3 only supports Gateway Endpoints (and optionally, PrivateLink for S3 via interface endpoints in some regions, but the standard and most cost-effective method is a Gateway Endpoint, which is the intended correct answer).

Practice this question →
355
MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16 and has enabled VPC Flow Logs to capture all traffic. The logs show that an EC2 instance (10.0.1.10) is sending outbound traffic to an external IP (203.0.113.50) on port 443, but the traffic is being rejected. The instance's security group allows outbound HTTPS to 0.0.0.0/0, and the subnet's NACL allows outbound traffic on port 443. The VPC has an internet gateway attached, and the route table directs 0.0.0.0/0 to the internet gateway. What is the most likely cause of the rejection?

A.The NACL inbound rules are blocking the return traffic.
B.The security group does not allow inbound HTTPS traffic.
C.The internet gateway is not attached to the VPC.
D.The route table does not have a route to the internet gateway.
AnswerA

NACLs are stateless and require explicit inbound rules for return traffic.

Why this answer

The outbound traffic from the EC2 instance is allowed by the security group and NACL outbound rules, but the return traffic (responses from 203.0.113.50:443 back to 10.0.1.10) must also be permitted by the subnet's NACL inbound rules. Since the NACL is stateless, it requires explicit inbound rules for ephemeral ports (typically 1024-65535) to allow the return traffic. If those inbound rules are missing, the return packets are dropped, causing the outbound traffic to appear as rejected in VPC Flow Logs.

Exam trap

AWS often tests the distinction between stateful security groups and stateless NACLs, specifically that NACLs require explicit inbound rules for return traffic while security groups automatically allow it.

How to eliminate wrong answers

Option B is wrong because the security group is stateful, so inbound HTTPS rules are not required for return traffic; the stateful nature of security groups automatically allows response traffic for outbound connections. Option C is wrong because the question explicitly states the VPC has an internet gateway attached. Option D is wrong because the route table directs 0.0.0.0/0 to the internet gateway, so the route is correctly configured.

Practice this question →
356
MCQmedium

A company has a VPC with public and private subnets. They have a NAT gateway in a public subnet. They want to provide internet access to instances in private subnets. The NAT gateway is configured with an Elastic IP. The private instances still cannot access the internet. The route table for the private subnets has a default route (0.0.0.0/0) pointing to the NAT gateway. What is missing?

A.The network ACL for the private subnet allows outbound traffic
B.The private subnet route table is missing a route to the NAT gateway
C.The security group for the instances allows outbound traffic
D.The route table for the public subnet where the NAT gateway resides does not have a default route to an internet gateway
AnswerD

The NAT gateway needs internet access itself to forward traffic.

Why this answer

The private instances can't access the internet because the NAT gateway itself is in a public subnet that lacks a route to an internet gateway. The route table for the public subnet where the NAT gateway resides must have a default route (0.0.0.0/0) pointing to an internet gateway for the NAT gateway to reach the internet. Without this, the NAT gateway cannot forward traffic from the private instances to the internet.

Option A is not the best answer because network ACLs are stateless and by default allow outbound traffic, but they could be misconfigured; however, the most common missing piece is the public subnet's route table. Option B is incorrect because the private subnet route table already has the default route to the NAT gateway. Option C is incorrect because security groups are stateful and automatically allow outbound traffic if inbound is allowed, so they are not blocking.

Practice this question →
357
MCQeasy

A company is deploying a new application in a VPC with public and private subnets. The application servers in the private subnets need to access the internet to download patches. Which configuration meets this requirement without allowing inbound internet traffic?

A.Attach an internet gateway to the private subnets and configure route tables accordingly.
B.Create a NAT gateway in a public subnet and add a route to the NAT gateway from the private subnets' route tables.
C.Establish a site-to-site VPN connection to an on-premises internet gateway.
D.Configure a VPC endpoint for the internet in the private subnets.
AnswerB

A NAT gateway allows outbound internet traffic from private subnets while preventing unsolicited inbound connections.

Why this answer

A NAT gateway in a public subnet allows instances in private subnets to initiate outbound connections to the internet (e.g., for patch downloads) while preventing unsolicited inbound traffic from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway's elastic network interface. This is the standard AWS pattern for outbound-only internet access from private subnets.

Exam trap

The trap here is that candidates confuse a NAT gateway with an internet gateway, assuming both provide internet access, but an internet gateway enables bidirectional traffic (including inbound), while a NAT gateway strictly enforces outbound-only access from private subnets.

How to eliminate wrong answers

Option A is wrong because attaching an internet gateway directly to private subnets would expose them to inbound internet traffic, violating the requirement to block inbound traffic; internet gateways allow bidirectional communication. Option C is wrong because a site-to-site VPN connects to an on-premises network, not the internet, and would not provide general internet access for patch downloads unless the on-premises network has its own internet breakout, which is not stated. Option D is wrong because VPC endpoints provide private connectivity to specific AWS services (e.g., S3, DynamoDB) via AWS PrivateLink, not general internet access; they cannot reach arbitrary internet hosts.

Practice this question →
358
MCQmedium

A security team wants to block traffic from a specific IP address (203.0.113.5) from reaching an EC2 instance. The instance is in a public subnet with a security group that allows all traffic from the internet. A network ACL is associated with the subnet. The team adds a DENY rule for the IP in the network ACL. However, traffic from that IP still reaches the instance. What is the most likely reason?

A.The network ACL has an ALLOW rule with a lower rule number that matches the IP, so the DENY rule is never evaluated.
B.The security group allows traffic from the IP, overriding the network ACL.
C.The network ACL is applied to the wrong subnet.
D.The internet gateway is ignoring the network ACL.
AnswerA

Network ACLs are processed in rule number order; the first matching rule is applied.

Why this answer

Network ACLs are stateless and evaluated in order by rule number, from lowest to highest. If an ALLOW rule with a lower rule number (e.g., 100) matches the source IP 203.0.113.5 before the DENY rule (e.g., 200) is reached, the ALLOW rule will be applied and the traffic permitted. The DENY rule is never evaluated because the first matching rule determines the action.

Exam trap

The trap here is that candidates assume a DENY rule in a network ACL will always block traffic, forgetting that network ACLs are evaluated in rule-number order and the first matching rule wins, so a lower-numbered ALLOW rule can permit the traffic before the DENY rule is even considered.

How to eliminate wrong answers

Option A is correct as described. Option B is wrong because security groups are stateful and can only allow traffic; they cannot override a network ACL deny, but in this case the network ACL's ALLOW rule is permitting the traffic before the DENY rule is evaluated. Option C is wrong because if the network ACL were applied to the wrong subnet, traffic from the IP would either be blocked or allowed based on that ACL's rules, but the question states the ACL is associated with the subnet and the team added a DENY rule, so misapplication would not cause the specific symptom of the DENY rule being ignored.

Option D is wrong because an internet gateway does not evaluate network ACLs; it forwards traffic to the subnet, where the subnet's network ACL is evaluated by the VPC router.

Practice this question →
359
MCQeasy

A company is designing a network for a highly available application across multiple AWS regions. The application requires low-latency communication between regions and uses IP addresses that cannot change. Which AWS service should be used to connect the VPCs in different regions?

A.AWS Direct Connect
B.VPC Endpoints
C.VPC Peering
D.Internet Gateway
AnswerC

VPC peering supports inter-region connectivity.

Why this answer

VPC Peering is the correct choice because it establishes a direct, private network connection between two VPCs in different AWS regions using AWS's global backbone, enabling low-latency communication without requiring public internet traversal. It supports inter-region peering (since 2017) and allows the use of private IP addresses that remain unchanged, satisfying the requirement for fixed IPs.

Exam trap

The ANS-C01 exam often tests the misconception that VPC Peering is only for same-region VPCs, but AWS has supported inter-region VPC Peering since 2017, making it a valid and recommended solution for cross-region private connectivity with fixed IPs.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated on-premises to AWS connection service, not designed for VPC-to-VPC connectivity across regions; it would require additional transit VPC or VPN setups and does not natively connect VPCs. Option B is wrong because VPC Endpoints (Gateway or Interface) enable private access to AWS services (e.g., S3, DynamoDB) from within a VPC, not connectivity between VPCs in different regions. Option D is wrong because an Internet Gateway allows a VPC to communicate with the public internet, not private inter-VPC communication, and would expose traffic to public transit, violating the fixed IP and low-latency requirements.

Practice this question →
360
MCQmedium

A company is deploying a multi-tier web application on AWS. The web tier runs on EC2 instances behind an Application Load Balancer (ALB), and the application tier runs on EC2 instances that connect to an RDS MySQL Multi-AZ DB instance. The application tier must be isolated from the internet and only accessible from the web tier. Which network implementation meets these requirements with the LEAST administrative overhead?

A.Place the web tier in a public subnet and the application tier in a private subnet, and configure security groups to allow inbound traffic to the application tier only from the web tier's security group.
B.Create two VPCs: one for the web tier with a public subnet, and one for the application tier with a private subnet, and connect them using VPC peering.
C.Place the web tier in a public subnet and the application tier in a private subnet with a NAT gateway for outbound access, and use security groups to allow traffic from the web tier.
D.Place both tiers in the same public subnet, and use a network ACL to restrict traffic from the web tier to the application tier.
AnswerA

This achieves isolation with minimal overhead.

Why this answer

Placing the web tier in a public subnet and the application tier in a private subnet, then using a security group rule that references the web tier's security group as the source, provides a stateful, application-layer firewall that allows traffic only from the web tier to the application tier. This design isolates the application tier from the internet while requiring no additional infrastructure like NAT gateways or VPC peering, minimizing administrative overhead. The security group reference automatically scales with the web tier's instances, eliminating the need to manage IP addresses.

Exam trap

The trap here is that candidates often over-engineer the solution by adding unnecessary components like NAT gateways or VPC peering, misunderstanding that security group references can securely allow traffic from a public subnet to a private subnet within the same VPC without internet gateway or NAT involvement.

How to eliminate wrong answers

Option B is wrong because using two separate VPCs with VPC peering introduces unnecessary complexity and administrative overhead (e.g., managing route tables, peering connections, and cross-VPC security group references) compared to a single VPC with public and private subnets. Option C is wrong because a NAT gateway is not required for the application tier to be accessible from the web tier; the web tier initiates traffic to the private subnet, and the application tier does not need outbound internet access for this requirement. Option D is wrong because placing both tiers in the same public subnet exposes the application tier to the internet, violating the isolation requirement, and network ACLs are stateless, requiring explicit rules for return traffic, which increases administrative overhead and risk of misconfiguration.

Practice this question →
361
MCQeasy

A company wants to ensure that traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the network engineer do to meet this requirement?

A.Create an AWS Site-to-Site VPN between the VPCs and disable the VPC peering connection.
B.Use TLS or IPsec at the application layer between instances.
C.Replace the VPC peering connection with a Transit Gateway and enable VPN encryption.
D.Enable encryption on the VPC peering connection.
AnswerB

Application-layer encryption provides encryption over the peering connection.

Why this answer

VPC peering connections do not support native encryption of traffic. To meet the requirement for encryption in transit between two VPCs connected via a VPC peering connection, you must implement encryption at the application layer using TLS or IPsec between the instances. This ensures that traffic is encrypted end-to-end, independent of the underlying network path.

Exam trap

The trap here is that candidates often assume VPC peering connections are inherently encrypted because they use the AWS private network, but AWS does not encrypt traffic over VPC peering; encryption must be implemented at the application or instance layer.

How to eliminate wrong answers

Option A is wrong because creating an AWS Site-to-Site VPN between the VPCs would require a virtual private gateway and a customer gateway in each VPC, which is not supported for VPC-to-VPC connections without a Transit Gateway or a third-party appliance; additionally, disabling the VPC peering connection is unnecessary and does not solve the encryption requirement. Option C is wrong because replacing the VPC peering connection with a Transit Gateway does not inherently enable VPN encryption; you would need to attach VPN attachments to the Transit Gateway, which adds complexity and cost, and the question specifically states the VPCs are already connected via a VPC peering connection. Option D is wrong because VPC peering connections do not support enabling encryption natively; there is no toggle or setting to encrypt traffic over a VPC peering connection.

Practice this question →
362
MCQeasy

A company is setting up a Direct Connect connection between its on-premises data center and AWS. The company wants to use a single virtual interface (VIF) to access multiple VPCs in the same AWS Region. Which AWS service should be used to achieve this?

A.Direct Connect gateway
B.VPC peering connection
C.AWS VPN CloudHub
D.Transit VPC
AnswerA

A Direct Connect gateway enables a single virtual interface to connect to multiple VPCs.

Why this answer

A Direct Connect gateway allows you to associate multiple Virtual Private Clouds (VPCs) in the same AWS Region with a single Direct Connect virtual interface (VIF). This is achieved by creating a Direct Connect gateway and attaching it to the VIF, then associating the desired VPCs with the gateway via virtual private gateways (VGWs) or transit gateways. This enables centralized, private connectivity from on-premises to multiple VPCs without needing separate VIFs per VPC.

Exam trap

The trap here is that candidates often confuse a Direct Connect gateway with a Transit Gateway, but the question explicitly asks for the service to use with a single VIF, and a Direct Connect gateway is the correct component that directly attaches to the VIF, whereas a Transit Gateway is a separate construct that can also be used but requires additional configuration and is not the direct answer for 'using a single VIF to access multiple VPCs'.

How to eliminate wrong answers

Option B is wrong because VPC peering connections provide connectivity between two VPCs but do not integrate with Direct Connect to allow a single VIF to reach multiple VPCs; peering is a point-to-point connection and cannot be used to extend on-premises access to multiple VPCs via a single VIF. Option C is wrong because AWS VPN CloudHub is a hub-and-spoke VPN model that connects multiple on-premises sites to a single VPC using VPN tunnels, not a solution for using a single Direct Connect VIF to access multiple VPCs. Option D is wrong because Transit VPC is a legacy architecture that uses software VPN appliances in a central VPC to route traffic to other VPCs, but it does not leverage a Direct Connect gateway and is not the recommended AWS-native service for this purpose; the modern equivalent is a Transit Gateway, but the question specifically asks for the service to use with a single VIF, which is the Direct Connect gateway.

Practice this question →
363
Multi-Selecthard

Which TWO of the following are best practices for securing a VPC with AWS Network Firewall? (Choose two.)

Select 2 answers
A.Deploy firewall endpoints in at least two Availability Zones for high availability.
B.Use only stateless rules to minimize processing overhead.
C.Configure stateful rule groups to inspect traffic at the application layer.
D.Use Network Firewall only for outbound traffic filtering.
E.Deploy the firewall in the same subnet as the workload for low latency.
AnswersA, C

Ensures resilience.

Why this answer

Deploying AWS Network Firewall endpoints in at least two Availability Zones ensures high availability and fault tolerance. If one AZ or firewall endpoint fails, traffic can be routed through the other, preventing a single point of failure. This aligns with AWS best practices for resilient network architectures.

Exam trap

The trap here is that candidates often assume stateless rules are sufficient for security or that Network Firewall is only for outbound filtering, but the exam tests the understanding that stateful inspection and multi-AZ deployment are critical for comprehensive protection and high availability.

Practice this question →
364
Multi-Selectmedium

A company is designing a highly available network in AWS. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to use BGP as the routing protocol. Which TWO actions should be taken to ensure high availability?

Select 2 answers
A.Use the same BGP community values for both connections
B.Advertise the same on-premises prefixes over both connections with different AS_PATH prepend values
C.Enable jumbo frames on both connections
D.Configure multiple virtual interfaces on a single Direct Connect connection
E.Configure separate BGP sessions for each Direct Connect connection
AnswersB, E

Allows path selection and failover.

Why this answer

Options B and E are correct. B: Advertising the same on-premises prefixes over both connections with different AS_PATH prepend values allows you to influence inbound traffic path selection, favoring the connection with the shorter AS_PATH (less prepending). E: Configuring separate BGP sessions for each Direct Connect connection ensures that if one connection or BGP session fails, the other remains active, providing redundancy.

Option A is wrong because BGP community values do not directly influence path selection; they are used for tagging and policy. Option C is wrong because jumbo frames affect MTU, not high availability. Option D is wrong because multiple virtual interfaces on a single connection create a single point of failure; separate connections are needed for high availability.

Practice this question →
365
MCQhard

A company is deploying a multi-region application using two AWS Regions. They want to use an AWS Transit Gateway to interconnect VPCs within each region, and they need to interconnect the Transit Gateways across regions. Which is the most scalable and reliable approach?

A.Use Transit Gateway peering attachments between the Transit Gateways in each region.
B.Create a VPC peering connection between VPCs in different regions and attach them to the Transit Gateways.
C.Use AWS Site-to-Site VPN connections between the Transit Gateways in each region.
D.Set up a Direct Connect gateway with virtual interfaces in each region and propagate routes.
AnswerA

Transit Gateway peering is the native, scalable, and reliable method to interconnect Transit Gateways across regions.

Why this answer

AWS Transit Gateway supports inter-region peering, which is the recommended method for connecting Transit Gateways across regions. Option A is correct. Option B is incorrect because VPC peering does not natively interconnect Transit Gateways.

Option C is incorrect because using AWS Site-to-Site VPN connections adds complexity, reduces bandwidth, and is less reliable compared to Transit Gateway peering. Option D is incorrect because a Direct Connect gateway is designed for connecting on-premises networks to AWS, not for interconnecting Transit Gateways across regions.

Practice this question →
366
MCQhard

A company is designing a network architecture for a critical application that requires high availability and low latency. The application will be deployed on EC2 instances in an Auto Scaling group across three Availability Zones in a single region. The instances will communicate with an Amazon RDS database. Which configuration will provide the MOST resilient and performant network connectivity?

A.Launch a single RDS instance in a public subnet and use Route 53 latency-based routing to direct traffic.
B.Use a Network Load Balancer in front of the RDS instance to distribute connections across Availability Zones.
C.Place the RDS instance in a single Availability Zone and use a read replica in another AZ for failover.
D.Create an RDS Multi-AZ cluster with one writer and two reader instances in different AZs, and use the cluster endpoint for writes and reader endpoint for reads.
AnswerD

Multi-AZ cluster provides automatic failover and low-latency reads across AZs.

Why this answer

A Multi-AZ cluster with one writer and two reader instances provides both high availability and low latency. The cluster endpoint automatically routes write traffic to the primary instance, while the reader endpoint distributes read traffic across the reader instances in different Availability Zones, reducing latency and improving resilience. This architecture ensures that if one Availability Zone fails, the database remains available without manual intervention, meeting the critical application's requirements.

Exam trap

The ANS-C01 exam often tests the misconception that a Network Load Balancer can be used to distribute traffic to an RDS database, but RDS does not support load balancers for database connections, and the correct approach is to use Multi-AZ cluster endpoints for high availability and read scaling.

How to eliminate wrong answers

Option A is wrong because launching a single RDS instance in a public subnet exposes the database to the internet, compromising security, and Route 53 latency-based routing cannot provide automatic failover or high availability for a single database instance. Option B is wrong because a Network Load Balancer cannot be placed in front of an RDS instance; RDS does not support load balancers for direct database connections, and the NLB operates at Layer 4, which cannot handle database-specific connection routing or failover. Option C is wrong because placing the RDS instance in a single Availability Zone creates a single point of failure; a read replica in another AZ provides read scalability but does not offer automatic failover for writes, and the primary instance failure would still cause downtime.

Practice this question →
367
MCQmedium

A company has a Direct Connect connection with a private virtual interface (VIF) attached to a Virtual Private Gateway (VGW) that is associated with a single VPC (10.0.0.0/16). The on-premises network uses BGP to exchange routes. The company has recently acquired another company and needs to connect to their VPC (172.16.0.0/16) in the same region. They want to use the existing Direct Connect connection to access both VPCs. The network engineer creates a Transit Gateway, attaches both VPCs, and creates a transit virtual interface (VIF) to the Transit Gateway. The engineer also deletes the private VIF. However, after the change, on-premises users cannot reach either VPC. What should the engineer do to restore connectivity?

A.Configure BGP on the on-premises router to peer with the Transit Gateway over the transit VIF.
B.Attach the VPCs to the Transit Gateway with different route tables.
C.Create a new private VIF to each VPC.
D.Enable route propagation on the Transit Gateway route tables.
AnswerA

BGP must be configured for route exchange.

Why this answer

When the private VIF was replaced with a transit VIF to the Transit Gateway, the on-premises router lost its BGP peering with the VGW. To restore connectivity, the on-premises router must be configured to establish BGP peering with the Transit Gateway over the transit VIF. This allows route exchange between on-premises and both VPCs attached to the Transit Gateway.

Option A is correct. Option B is incorrect because attaching VPCs with different route tables is not the issue; the VPCs are already attached. Option C is incorrect because creating separate private VIFs would be unnecessary and defeats the purpose of using a Transit Gateway.

Option D is incorrect because route propagation is already enabled by default when VPCs are attached to a Transit Gateway; the missing piece is the BGP session from on-premises.

Practice this question →
368
MCQhard

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to inspect traffic between VPCs using a centralized network virtual appliance (NVA) in a security VPC. What is the most scalable and highly available design to achieve this?

A.Place a single NVA in the Transit Gateway and route all inter-VPC traffic through it.
B.Create VPC peering connections between each VPC and the security VPC, then configure the NVAs to route traffic.
C.Attach all VPCs to a Transit Gateway, use separate route tables for inspection, and deploy NVAs behind a Gateway Load Balancer in the security VPC.
D.Use Direct Connect to connect all VPCs to a central location and route through NVAs there.
AnswerC

Transit Gateway provides transitive routing; GWLB provides HA and scale for NVAs.

Why this answer

It uses Transit Gateway with separate route tables to isolate inspection traffic, and deploys NVAs behind a Gateway Load Balancer (GWLB) in the security VPC. GWLB provides automatic scaling and health checks across multiple NVAs, ensuring high availability and scalability for inter-VPC traffic inspection without introducing a single point of failure or manual routing complexity.

Exam trap

The trap here is that candidates often assume a single NVA in the Transit Gateway (Option A) is feasible, but Transit Gateway is a managed service that cannot host customer appliances, and they overlook that VPC peering (Option B) lacks transitive routing, making it unsuitable for centralized inspection in a multi-VPC environment.

How to eliminate wrong answers

Option A is wrong because placing a single NVA in the Transit Gateway is not possible—Transit Gateway is a managed service that does not host customer NVAs; routing all traffic through a single NVA creates a single point of failure and a scalability bottleneck. Option B is wrong because VPC peering does not support transitive routing, so each VPC would need a separate peering connection to the security VPC, and traffic between non-security VPCs would require complex routing through the security VPC, which is not scalable and violates the hub-and-spoke design intent. Option D is wrong because Direct Connect connects on-premises networks to AWS, not VPCs to each other; using Direct Connect to interconnect VPCs would require additional VPNs or transit VIFs and does not provide a scalable or highly available inspection architecture for inter-VPC traffic.

Practice this question →
369
MCQeasy

A network engineer is troubleshooting connectivity from an on-premises network to an EC2 instance in a VPC via a Site-to-Site VPN. The VPN tunnel is up, but the engineer cannot ping the EC2 instance's private IP. What should the engineer check first?

A.The VPN connection status in the AWS console.
B.Security group inbound rules for ICMP on the EC2 instance.
C.IKE version mismatch between the VPN endpoints.
D.Route propagation and route tables in the VPC and on-premises.
AnswerD

Missing routes are a common cause.

Why this answer

The VPN tunnel being up indicates the IPsec/IKE negotiation succeeded, but reachability to the EC2 instance requires proper routing. The most common cause of ping failure when the tunnel is up is missing or incorrect route propagation from the VPN to the VPC route tables, or missing static routes on the on-premises side pointing to the VPN gateway. Without correct routes, traffic from the on-premises network cannot reach the VPC subnets, and return traffic from the EC2 instance cannot reach the on-premises network.

Exam trap

The trap here is that candidates assume a UP tunnel guarantees connectivity, but the tunnel state only confirms Layer 3 encryption is established, not that routing or security group rules allow traffic to flow.

How to eliminate wrong answers

Option A is wrong because the VPN connection status in the AWS console only shows the tunnel state (UP/DOWN), which is already confirmed as UP; checking it again provides no new information about routing or security. Option B is wrong because while security group inbound rules for ICMP could block ping, the question asks what to check first; routing is a prerequisite for any traffic to reach the EC2 instance, so checking security groups before routing is premature. Option C is wrong because an IKE version mismatch would prevent the VPN tunnel from coming up entirely, but the tunnel is already UP, so this cannot be the cause of the connectivity issue.

Practice this question →
370
MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. The company also has a Site-to-Site VPN connection to the same VPC as a backup. During a failover test, traffic from on-premises to the VPC continues to use the Direct Connect even after it is intentionally failed. The BGP timers are set to default values. What is the most likely cause?

A.The Direct Connect route is more specific than the VPN route.
B.The VPN BGP route has a longer AS path than the Direct Connect route.
C.The VPN route has a lower local preference than the Direct Connect route.
D.The BGP session with the Direct Connect router is still established because the physical link is up, but the link is not forwarding traffic.
AnswerD

If the BGP session remains established, routes are still advertised and the Direct Connect route remains in the routing table, causing traffic to still be sent.

Why this answer

The Direct Connect physical link is still up, so the BGP session remains established even though the link is not forwarding traffic. With default BGP timers (keepalive 60s, hold 180s), the session does not time out, so the VPC continues to receive the Direct Connect route and prefers it over the VPN backup. A failover requires either the BGP session to go down or the route to be withdrawn, neither of which occurs when only the data plane fails.

Exam trap

The ANS-C01 exam often tests the misconception that a physical link failure is required for BGP to withdraw routes, but the trap here is that BGP can remain established even when the data plane is broken, so the backup VPN never activates.

How to eliminate wrong answers

Option A is wrong because route specificity (prefix length) determines BGP best path selection only if both routes are from the same protocol and have equal local preference and AS path length; here, the issue is that the Direct Connect route is still present, not that it is more specific. Option B is wrong because a longer AS path would make the VPN route less preferred, but the problem is that the Direct Connect route is still active and preferred, not that the VPN route has a longer AS path. Option C is wrong because local preference is typically set to 100 by default for both routes, and even if the VPN route had a lower local preference, the Direct Connect route would still be preferred; the core issue is that the Direct Connect route is not being withdrawn.

Practice this question →
371
Multi-Selecthard

A company is implementing a network segmentation strategy using AWS Transit Gateway. They have three VPCs: production, development, and shared services. They need to ensure that production and development VPCs can both access shared services, but cannot communicate with each other. Which THREE configurations are required?

Select 3 answers
A.Create a route table for the shared services VPC that allows routes to both production and development
B.Attach each VPC to the transit gateway
C.Create a separate route table for the production and development VPCs that allows only routes to shared services
D.Create a VPC peering connection between production and development
E.Use a single transit gateway route table for all attachments
AnswersA, B, C

Shared services must be able to send traffic back.

Why this answer

The shared services VPC needs a transit gateway route table with routes to both the production and development VPC attachments so that return traffic from shared services can reach those VPCs. Without these routes, the transit gateway would drop return packets, breaking bidirectional communication.

Exam trap

The trap here is that candidates often assume a single transit gateway route table is sufficient for all attachments, overlooking that separate route tables are required to enforce isolation between specific VPCs while allowing shared access.

Practice this question →
372
MCQmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from an S3 bucket. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should be implemented?

A.Use an Interface VPC Endpoint for S3
B.Use AWS Direct Connect
C.Set up a NAT Gateway in the public subnet and route traffic through it
D.Create a Gateway VPC Endpoint for S3
AnswerD

Gateway endpoint provides private, low-cost access to S3.

Why this answer

A Gateway VPC Endpoint for S3 allows EC2 instances in a private subnet to access S3 without traversing the internet, using AWS's internal network. This minimizes data transfer costs because Gateway Endpoints are free and traffic stays within the AWS backbone, avoiding NAT Gateway or internet gateway charges.

Exam trap

The ANS-C01 exam often tests the distinction between Gateway and Interface VPC Endpoints, trapping candidates who assume all endpoints are Interface-based or that NAT Gateway is the only way to access AWS services from private subnets.

How to eliminate wrong answers

Option A is wrong because an Interface VPC Endpoint for S3 incurs hourly charges and data processing costs, and while it avoids internet traversal, it is not the most cost-effective solution compared to a Gateway Endpoint. Option B is wrong because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not designed for VPC-to-S3 traffic within the same region, and it adds unnecessary complexity and cost. Option C is wrong because a NAT Gateway in the public subnet would route traffic to the internet, incurring NAT Gateway hourly and data processing charges, and it does not minimize data transfer costs or avoid internet traversal as effectively as a Gateway Endpoint.

Practice this question →
373
MCQmedium

A company is migrating an on-premises application to AWS. The application uses multicast for discovery. Which AWS service supports multicast traffic within a VPC?

A.AWS Transit Gateway
B.VPC peering
C.Application Load Balancer
D.Amazon CloudFront
AnswerA

Supports multicast groups and routing.

Why this answer

AWS Transit Gateway supports multicast traffic within a VPC by acting as a multicast router. It allows you to create multicast domains and associate subnets, enabling multicast group communication (using IGMP) for applications like service discovery. This makes it the correct choice for migrating an on-premises application that relies on multicast.

Exam trap

The trap here is that candidates often assume VPC peering supports all traffic types, but AWS explicitly does not support multicast or broadcast over VPC peering, making Transit Gateway the only native multicast solution within a VPC.

How to eliminate wrong answers

Option B (VPC peering) is wrong because VPC peering does not support multicast or broadcast traffic; it only allows unicast communication between VPCs. Option C (Application Load Balancer) is wrong because it operates at Layer 7 and handles HTTP/HTTPS traffic, not multicast IP traffic. Option D (Amazon CloudFront) is wrong because it is a content delivery network (CDN) that distributes content via HTTP/HTTPS, not a multicast routing service.

Practice this question →
374
MCQhard

A company has a VPC with a transit gateway (TGW) connected to multiple VPCs and an on-premises network via AWS Direct Connect. The on-premises network advertises a specific prefix 10.0.0.0/16. A VPC attachment in the same region also advertises the same prefix. The TGW route table has the on-premises route as static and the VPC route as propagated. Which route will be used for traffic destined to 10.0.0.5?

A.The propagated route from VPC
B.The static route to on-premises
C.Both routes will be used with ECMP
D.The route with the shortest AS_PATH
AnswerB

Static routes have higher precedence than propagated.

Why this answer

When a transit gateway (TGW) receives both a static route and a propagated route for the same prefix, the static route takes precedence regardless of the propagation source. This is because static routes have a higher administrative distance (lower priority number) than dynamically learned routes. Therefore, traffic destined to 10.0.0.5 will be forwarded via the Direct Connect attachment to the on-premises network.

Exam trap

The ANS-C01 exam often tests the misconception that propagated routes from VPC attachments are preferred over static routes, or that ECMP applies when two routes for the same prefix exist, but the key trap is that static routes always override propagated routes in a TGW route table regardless of the source.

How to eliminate wrong answers

Option A is wrong because propagated routes are dynamic and have a lower priority than static routes in the TGW route table; the static route to on-premises will override the propagated VPC route. Option C is wrong because ECMP (Equal-Cost Multi-Path) requires multiple routes with identical prefix and equal administrative distance, but here the static and propagated routes have different priorities, so only the static route is active. Option D is wrong because AS_PATH length is a BGP attribute used for route selection in BGP, but TGW static routes are not BGP-learned and are selected based on route table precedence rules, not AS_PATH.

Practice this question →
375
Multi-Selecthard

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Direct Connect and a Site-to-Site VPN. The on-premises network advertises 10.0.0.0/8 over BGP. The company wants to ensure that traffic to the VPC's specific subnet 10.0.1.0/24 is routed via the VPN, while all other traffic to 10.0.0.0/8 uses Direct Connect. Which THREE actions should the network engineer take?

Select 3 answers
A.Set a higher BGP local preference on the VPN routes compared to Direct Connect routes for the same prefix.
B.Advertise a more specific route for 10.0.1.0/24 over the VPN BGP session.
C.Disable route propagation on the VPN connection's route table.
D.Prepend the AS path on the Direct Connect BGP advertisement for the 10.0.1.0/24 prefix to make it less preferred.
E.Delete the VPN connection and rely solely on Direct Connect.
AnswersA, B, D

Higher local preference is preferred.

Why this answer

Setting a higher BGP local preference on the VPN routes makes them more preferred over Direct Connect routes for the same prefix. Since the on-premises network advertises 10.0.0.0/8 over both connections, BGP local preference is the first tiebreaker; a higher value on the VPN side ensures that traffic to 10.0.1.0/24 uses the VPN as desired.

Exam trap

The trap here is that candidates often think AS path prepending alone is sufficient to influence route preference, but they forget that local preference is evaluated before AS path length in BGP path selection, and that a more specific prefix advertisement (10.0.1.0/24) will always be preferred over a less specific one (10.0.0.0/8) regardless of BGP attributes.

Practice this question →
← PreviousPage 5 of 6 · 416 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Network Implementation questions.

Start 20-question session