CCNA Network Implementation Questions — Page 6 of 6

376

MCQhard

A company has a Direct Connect connection with a private VIF connected to a VPC. The network engineer notices that traffic from on-premises to the VPC is being dropped intermittently. The on-premises router shows BGP session is up, but the VPC route table does not have the on-premises prefix. What is the most likely cause?

A.The MTU on the on-premises router is set too high.

B.The BGP session is flapping due to high latency.

C.The on-premises router is advertising a route that is more specific than the allowed prefix list on the Direct Connect gateway.

D.The on-premises router is using AS_PATH prepending.

AnswerC

The allowed prefix list on the Direct Connect gateway may not include the specific prefix, causing the route to be rejected.

Why this answer

The Direct Connect gateway (DXGW) uses allowed prefix lists to control which routes are accepted from the on-premises router via BGP. If the on-premises router advertises a prefix that is more specific (e.g., /28) than the allowed prefix list (e.g., /24), the DXGW will reject the route, causing the VPC route table to lack the on-premises prefix. The BGP session remains up because the session itself is not affected, but the specific route is not installed.

Exam trap

AWS often tests the distinction between BGP session state and route acceptance, trapping candidates who assume a stable BGP session guarantees route installation, when in fact prefix filtering on the DXGW can silently drop specific routes.

How to eliminate wrong answers

Option A is wrong because MTU settings affect packet fragmentation and delivery, not BGP route advertisement or route table population; a high MTU would cause packet drops due to size mismatch, not intermittent route absence. Option B is wrong because if the BGP session were flapping due to high latency, the on-premises router would show the session as up/down, not consistently up; the question states the BGP session is up, ruling out flapping. Option D is wrong because AS_PATH prepending influences route preference and path selection, not route acceptance; it does not cause the VPC route table to miss the prefix entirely.

Practice this question →

377

MCQeasy

A company is deploying a VPC with public and private subnets. The private subnets need outbound internet access for updates, but must not be directly reachable from the internet. Which AWS service should be used to achieve this?

A.AWS Site-to-Site VPN

B.AWS Direct Connect

C.Internet Gateway

D.NAT Gateway

AnswerD

NAT Gateway provides outbound internet access for private subnets while blocking inbound internet traffic.

Why this answer

A NAT Gateway enables instances in private subnets to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It translates the private source IP to the NAT Gateway's Elastic IP address, so responses return to the gateway, which then forwards them to the private instance. This meets the requirement of outbound-only internet access without direct internet reachability.

Exam trap

The ANS-C01 exam often tests the misconception that an Internet Gateway can be used in a private subnet by simply not assigning public IPs, but the trap is that an Internet Gateway inherently allows inbound traffic from the internet to any instance with a public IP or via its route, making it unsuitable for private subnets that must not be directly reachable.

How to eliminate wrong answers

Option A is wrong because AWS Site-to-Site VPN creates an encrypted tunnel to an on-premises network, not to the public internet; it does not provide outbound internet access for private subnets. Option B is wrong because AWS Direct Connect establishes a dedicated private connection to an on-premises data center, not to the internet, and does not enable outbound internet access. Option C is wrong because an Internet Gateway allows bidirectional communication between VPC instances and the internet; attaching it to a private subnet would make those instances directly reachable from the internet, violating the requirement.

Practice this question →

378

MCQeasy

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Site-to-Site VPN. The on-premises network uses 10.0.0.0/8. What should be done to avoid overlapping CIDRs?

A.Configure a VPN with overlapping CIDRs, it will still work

B.Use NAT on the customer gateway to translate addresses

C.Create a new VPC with a non-overlapping CIDR and migrate resources

D.Use VPC peering to connect to on-premises

AnswerC

Changing the VPC CIDR requires recreation; a new VPC is the practical solution.

Why this answer

AWS Site-to-Site VPN requires non-overlapping IP CIDRs between the VPC and the on-premises network for proper routing. The VPC uses 10.0.0.0/16, which falls entirely within the on-premises 10.0.0.0/8, causing a conflict that prevents the VPN from establishing routes correctly. Creating a new VPC with a non-overlapping CIDR (e.g., 172.16.0.0/16) and migrating resources resolves the overlap, enabling the VPN connection.

Exam trap

The ANS-C01 exam often tests the misconception that NAT on the customer gateway can solve overlapping CIDR issues in Site-to-Site VPN, but candidates must understand that NAT does not resolve the underlying routing conflict because the VPC still sees the overlapping range as local.

How to eliminate wrong answers

Option A is wrong because configuring a VPN with overlapping CIDRs will not work; AWS Site-to-Site VPN relies on unique IP address spaces to route traffic correctly, and overlapping ranges cause routing conflicts and packet loss. Option B is wrong because NAT on the customer gateway translates source addresses for outbound traffic but does not resolve the fundamental routing conflict; the VPC and on-premises networks still have overlapping CIDRs, and AWS cannot distinguish between local and remote destinations. Option D is wrong because VPC peering is used to connect two VPCs within AWS, not to connect a VPC to an on-premises network; it does not support VPN or Direct Connect connections to external networks.

Practice this question →

379

Drag & Dropmedium

Order the steps to set up a redundant Direct Connect connection with two virtual interfaces in different AWS regions:

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First provision the connections, then create VIFs, configure BGP, tune routing, then test failover.

Practice this question →

380

MCQhard

A company has a VPC with CIDR 10.0.0.0/16. They have a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They have a Network Load Balancer (NLB) in the public subnet, and EC2 instances in the private subnet. The NLB has a target group pointing to the EC2 instances. The security group for the EC2 instances allows traffic from the NLB's private IP addresses on port 80. The network ACL for the private subnet allows inbound traffic on port 80 from the public subnet CIDR and outbound ephemeral ports to 0.0.0.0/0. However, clients connecting to the NLB experience intermittent timeouts. The network engineer checks the NLB logs and sees that connections are established but occasionally drop. The engineer also notices that the EC2 instances have a default route to a NAT Gateway in the public subnet. What is the most likely cause of the intermittent timeouts?

A.Cross-zone load balancing is disabled on the NLB.

B.The NLB health checks are failing, causing targets to be removed.

C.The EC2 instances have a default route to the NAT Gateway, causing asymmetric routing.

D.The security group for the NLB is blocking inbound traffic.

AnswerC

Return traffic goes to NAT instead of NLB, breaking the connection.

Why this answer

The NLB with client IP preservation sends traffic to targets with the client's source IP. The EC2 instances have a default route pointing to the NAT Gateway. When the instance responds to a client, the response is routed to the NAT Gateway (because the destination is the client's IP, which is outside the VPC).

The NAT Gateway then sends the response to the internet, but the client expects the response from the NLB's IP address. This asymmetric routing causes the NLB to not see the response, leading to intermittent timeouts. Options A, B, and D are incorrect: disabling cross-zone load balancing does not cause timeouts, health checks are independent, and NLB does not have security groups.

Practice this question →

381

MCQhard

A company has a VPC with multiple subnets across three Availability Zones. They are deploying an NFS file system using Amazon EFS. They need high availability and low latency from all subnets. Which EFS deployment option meets these requirements?

A.Use EFS One Zone storage class with a single mount target in the same Availability Zone as the application.

B.Use EFS Standard storage class with Multi-AZ and create a single mount target in one Availability Zone.

C.Use EFS Standard storage class with Multi-AZ and create mount targets in each Availability Zone.

D.Use EFS One Zone storage class and create mount targets in each Availability Zone.

AnswerC

Standard storage is replicated across AZs; mount targets in each AZ provide low latency.

Why this answer

The EFS Standard storage class provides Multi-AZ durability and availability, and creating mount targets in each Availability Zone ensures that EC2 instances in any subnet can connect to EFS with low latency by using a mount target in the same AZ. This architecture avoids cross-AZ data transfer charges and minimizes latency, meeting both high availability and low latency requirements.

Exam trap

The ANS-C01 exam often tests the misconception that creating mount targets in every AZ alone guarantees high availability, but the storage class must also be Multi-AZ (Standard) to replicate data across AZs; otherwise, a single-AZ failure can cause data loss.

How to eliminate wrong answers

Option A is wrong because EFS One Zone storage class stores data in a single Availability Zone, which does not provide high availability across multiple AZs, and a single mount target cannot serve instances in other AZs with low latency. Option B is wrong because although EFS Standard is Multi-AZ, creating only one mount target forces instances in other AZs to route traffic across AZs, incurring higher latency and cross-AZ data transfer costs. Option D is wrong because EFS One Zone storage class is not Multi-AZ, so even with mount targets in each AZ, the underlying data is not replicated across AZs, failing the high availability requirement.

Practice this question →

382

MCQmedium

A company is deploying a web application across multiple Availability Zones in a VPC. The application needs to be highly available and scale based on traffic. The architecture includes an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. The company wants to ensure that if an Availability Zone fails, the ALB can still route traffic to healthy instances in other zones. What should the network engineer implement to meet this requirement?

A.Configure a Network Load Balancer instead of an ALB, and enable cross-zone load balancing.

B.Use an ALB with a target group that contains instances from only one Availability Zone, and use Route 53 health checks.

C.Deploy one ALB in each Availability Zone and use Route 53 latency-based routing.

D.Enable cross-zone load balancing on the ALB.

AnswerD

Cross-zone load balancing allows the ALB to distribute traffic across instances in all enabled AZs, providing high availability.

Why this answer

Enabling cross-zone load balancing on an Application Load Balancer (ALB) allows it to distribute incoming traffic evenly across all registered targets in all enabled Availability Zones. If an entire Availability Zone fails, the ALB automatically routes traffic only to healthy instances in the remaining zones, ensuring high availability without requiring manual intervention or additional components.

Exam trap

The ANS-C01 exam often tests the misconception that cross-zone load balancing is only relevant for Network Load Balancers or that it must be explicitly enabled for ALBs, when in fact ALBs have it enabled by default and it is the key mechanism for multi-AZ failover.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer (NLB) does not inherently provide better zone failover than an ALB; cross-zone load balancing is disabled by default on NLB and must be explicitly enabled, but the requirement specifically asks for an ALB, and the ALB already supports cross-zone load balancing. Option B is wrong because using a target group with instances from only one Availability Zone defeats the purpose of multi-AZ high availability; if that single zone fails, no healthy instances remain, and Route 53 health checks cannot reroute traffic to other zones because the ALB itself is a single endpoint. Option C is wrong because deploying one ALB per Availability Zone and using Route 53 latency-based routing introduces unnecessary complexity and does not guarantee seamless failover; each ALB is an independent endpoint, and if a zone fails, its ALB becomes unreachable, requiring DNS propagation delays and client-side retries, which violates the requirement for immediate traffic rerouting.

Practice this question →

383

MCQeasy

A company has several VPCs in the same AWS account and region. They want to centrally manage and monitor network traffic between these VPCs and also to on-premises networks. Which AWS service should they use?

A.AWS Direct Connect

B.VPC Peering

C.Transit Gateway

D.AWS VPN CloudHub

AnswerC

Transit Gateway provides a hub-and-spoke architecture for connecting multiple VPCs and on-premises networks.

Why this answer

AWS Transit Gateway (C) is the correct choice because it acts as a central hub to interconnect multiple VPCs and on-premises networks using a single gateway, simplifying network management and enabling centralized monitoring. It supports transitive routing between all attached networks, which is essential for the company's requirement to manage and monitor traffic across many VPCs and their on-premises environment.

Exam trap

The trap here is that candidates often confuse VPC Peering's ability to connect VPCs with the need for transitive routing, mistakenly thinking a mesh of peering connections is simpler than Transit Gateway, but they overlook the operational overhead and lack of centralized management.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated physical connection from on-premises to AWS, but it does not provide inter-VPC connectivity or centralized management of traffic between multiple VPCs; it only extends the on-premises network to AWS. Option B is wrong because VPC Peering creates a one-to-one, non-transitive connection between two VPCs, requiring a full mesh of peering connections for multiple VPCs, which becomes unmanageable and does not support centralized monitoring or on-premises integration without additional components. Option D is wrong because AWS VPN CloudHub is designed for connecting multiple remote sites (e.g., branch offices) to a single AWS VPN endpoint, not for interconnecting multiple VPCs within the same region or centrally managing VPC-to-VPC traffic.

Practice this question →

384

MCQhard

A company uses AWS Direct Connect with a private VIF to connect to a VPC. They have an on-premises application that needs to resolve private hosted zone names in Amazon Route 53. The on-premises DNS server forwards queries for the private domain to the VPC's DNS resolver. However, resolution fails. What is the most likely cause?

A.The private hosted zone is not associated with the VPC.

B.The VPC's DHCP option set is not configured to use the Route 53 Resolver.

C.The security group for the VPC DNS resolver is blocking inbound UDP port 53 from the on-premises network.

D.A Route 53 Resolver outbound endpoint is not configured to forward queries from on-premises to the VPC.

AnswerA

Correct. If the private hosted zone is not associated with the VPC, the VPC's DNS resolver will not have the zone's records, causing resolution failure even when queries are forwarded from on-premises.

Why this answer

The most likely cause is that the private hosted zone is not associated with the VPC. For Route 53 private hosted zones, the zone must be explicitly associated with the VPC in which the DNS resolver operates. If the zone is not associated, the VPC's DNS resolver (Route 53 Resolver) will not respond to queries for that domain, even if queries are forwarded from on-premises.

The on-premises DNS server forwards queries to the VPC's DNS resolver, but without zone association, the resolver has no knowledge of the private hosted zone. Options B and C are incorrect because DHCP option sets and security groups do not directly affect the VPC DNS resolver's ability to resolve private hosted zones. Option D is incorrect because an outbound endpoint is used to forward queries from the VPC to on-premises, not to accept inbound queries; the correct component would be an inbound endpoint, but the primary issue here is zone association.

Exam trap

The trap is that candidates often overlook the necessity of associating a private hosted zone with the VPC, and instead focus on DNS forwarding configurations like inbound/outbound endpoints. While an inbound endpoint is needed for on-premises resolution, the fundamental requirement is that the zone is associated with the VPC.

How to eliminate wrong answers

Option A is wrong because if the private hosted zone were not associated with the VPC, the VPC's DNS resolver would not be able to resolve the private domain at all, but the question states that the on-premises DNS server forwards queries to the VPC's DNS resolver, implying the VPC itself can resolve the domain; the issue is with the forwarding path, not the zone association. Option B is wrong because the DHCP option set for the VPC controls how instances in the VPC resolve DNS (e.g., using the VPC's DNS resolver IP), but it does not affect how the on-premises DNS server forwards queries to the VPC; the on-premises server is not using the VPC's DHCP options. Option C is wrong because the VPC's DNS resolver (the Route 53 Resolver) is not a traditional EC2 instance with a security group; it is an AWS-managed service that operates at the VPC network layer, and security groups do not apply to it; inbound UDP port 53 from on-premises is controlled by network ACLs or the Direct Connect routing, not by a security group.

Practice this question →

385

Multi-Selectmedium

A company has multiple VPCs that need to communicate with each other and with an on-premises network via AWS Transit Gateway. Which THREE of the following are valid attachment types for a transit gateway?

Select 3 answers

A.Direct Connect Gateway

B.Internet Gateway

C.Site-to-Site VPN connection

D.VPC

E.Network Load Balancer

AnswersA, C, D

Direct Connect Gateway can be associated with a transit gateway.

Why this answer

AWS Transit Gateway supports attachments to Direct Connect Gateways, enabling integration of Direct Connect virtual interfaces with the transit gateway for hybrid connectivity. This allows traffic from on-premises networks connected via Direct Connect to be routed through the transit gateway to multiple VPCs and other attachments.

Exam trap

The ANS-C01 exam often tests the misconception that any AWS networking component can be attached to a Transit Gateway, but only VPCs, Site-to-Site VPN connections, and Direct Connect Gateways are valid attachment types.

Practice this question →

386

Multi-Selectmedium

A company has a VPC with a CIDR of 10.0.0.0/16. They need to create subnets for a three-tier application. Which THREE subnet CIDR blocks are valid within this VPC?

Select 3 answers

A.10.0.1.0/24

B.10.0.3.0/24

C.10.0.5.0/24

D.10.1.0.0/24

E.10.0.0.0/8

AnswersA, B, C

Within 10.0.0.0/16.

Why this answer

(10.0.1.0/24) is a valid subnet within the VPC CIDR 10.0.0.0/16 because its entire address range (10.0.1.0–10.0.1.255) falls within the VPC's address space. The /24 subnet mask is smaller than the VPC's /16, so it is a proper subset. AWS VPCs allow any RFC 1918 private IP range as long as the subnet CIDR is fully contained within the VPC CIDR.

Exam trap

The ANS-C01 exam often tests the misconception that any private IP range can be used as a subnet as long as it starts with 10.x.x.x, but the subnet must be a strict subset of the VPC CIDR, not just any overlapping range.

Practice this question →

387

MCQeasy

A company is setting up a Site-to-Site VPN connection to AWS. The customer gateway device is behind a NAT device that performs address translation. Which tunnel option must be enabled to ensure the VPN tunnel establishes correctly?

A.Perfect Forward Secrecy (PFS)

B.NAT Traversal (NAT-T)

C.Dead Peer Detection (DPD)

D.IKEv2

AnswerB

Required to encapsulate IPsec in UDP to pass through NAT.

Why this answer

When a customer gateway device is behind a NAT device, the NAT device modifies the IP addresses and potentially the UDP ports in the IPsec packet headers. Standard IPsec (ESP) does not work through NAT because ESP is a Layer 4 protocol with no port numbers. NAT Traversal (NAT-T) solves this by encapsulating IPsec packets inside UDP (typically port 4500), allowing the NAT device to perform address translation without breaking the VPN tunnel.

Exam trap

The ANS-C01 exam often tests the misconception that IKEv2 alone solves NAT traversal, but in reality, NAT-T is a separate mechanism that must be enabled or negotiated regardless of the IKE version, and simply using IKEv2 does not automatically enable UDP encapsulation for ESP traffic.

How to eliminate wrong answers

Option A is wrong because Perfect Forward Secrecy (PFS) is a cryptographic property that ensures session keys are not compromised if long-term keys are exposed; it does not address NAT traversal issues. Option C is wrong because Dead Peer Detection (DPD) is a keepalive mechanism to detect if the remote peer is still reachable, but it does not solve the problem of IPsec packets being dropped or mangled by NAT. Option D is wrong because IKEv2 is a key exchange protocol version that supports NAT-T natively, but simply enabling IKEv2 without also enabling NAT-T (or using UDP encapsulation) will not fix the NAT traversal issue; NAT-T is a separate feature that must be explicitly enabled or negotiated.

Practice this question →

388

MCQhard

A company is experiencing intermittent connectivity issues between its on-premises network and AWS via a Direct Connect connection. The link is up, but packet loss is observed. Which test should the network engineer perform first to isolate the issue?

A.Run a traceroute with MTR

B.Ping the virtual private gateway

C.Perform a DNS lookup

D.Run a speed test

AnswerA

MTR shows loss per hop, helping identify the problematic segment.

Why this answer

MTR (My TraceRoute) combines the functionality of traceroute and ping to provide per-hop latency and packet loss statistics. This allows the engineer to pinpoint whether the packet loss is occurring on the Direct Connect link itself, the customer gateway, or somewhere in the transit path, rather than just confirming end-to-end reachability.

Exam trap

The trap here is that candidates assume pinging the virtual private gateway (Option B) is sufficient to verify the link, but it only confirms reachability and cannot isolate the specific hop causing packet loss, which is the primary goal of troubleshooting intermittent issues.

How to eliminate wrong answers

Option B is wrong because pinging the virtual private gateway only tests end-to-end reachability and cannot isolate where in the path the packet loss is occurring; it provides no per-hop visibility. Option C is wrong because a DNS lookup tests name resolution, not network-layer connectivity or packet loss, and is irrelevant to a physical or logical link issue. Option D is wrong because a speed test measures throughput and bandwidth, not packet loss or path-specific latency, and is not designed to diagnose intermittent packet loss on a Direct Connect circuit.

Practice this question →

389

MCQeasy

An application running on EC2 instances in a private subnet needs to send logs to Amazon CloudWatch Logs. Which step is essential to allow this communication without traversing the internet?

A.Create a VPC Interface Endpoint for CloudWatch Logs and attach it to the subnet.

B.Create a VPC Gateway Endpoint for CloudWatch Logs and update the route table.

C.Assign a public IP to the EC2 instance and route directly to the internet.

D.Attach a NAT Gateway to the private subnet and route traffic to the internet.

AnswerB

Provides private connectivity to CloudWatch Logs.

Why this answer

Amazon CloudWatch Logs supports both VPC Gateway Endpoints and VPC Interface Endpoints (PrivateLink). However, a Gateway Endpoint is more efficient as it does not require an Elastic Network Interface (ENI) and is accessed via route table entries, making it a simpler and more cost-effective solution for this scenario. Therefore, Option B is the appropriate choice.

Exam trap

The trap is that candidates may assume CloudWatch Logs only supports Interface Endpoints like many other AWS services, but in fact CloudWatch Logs supports Gateway Endpoints as well, which are often preferred for private connectivity without ENIs.

How to eliminate wrong answers

Option A is wrong because VPC Interface Endpoints are not supported for CloudWatch Logs; CloudWatch Logs only supports Gateway Endpoints, not Interface Endpoints. Option C is wrong because assigning a public IP to the EC2 instance would require the instance to be in a public subnet with an internet gateway, which violates the requirement of staying in a private subnet and not traversing the internet. Option D is wrong because a NAT Gateway provides internet access for private subnets, but the question explicitly states 'without traversing the internet,' making this solution non-compliant.

Practice this question →

390

MCQhard

A company has a Direct Connect connection with multiple Virtual Interfaces (VIFs) to an on-premises network. The VIFs are associated with a Direct Connect Gateway that is attached to multiple VPCs. The company is experiencing asymmetric routing and wants to ensure that traffic from on-premises to the VPCs always uses the same VIF. Which configuration should be implemented?

A.Use AS_PATH prepending on the VIFs to make one path more preferred

B.Enable Jumbo Frames on the Direct Connect connection

C.Set the Local Preference attribute on the AWS side

D.Configure BGP communities on the VIFs to influence route preference

AnswerD

BGP communities allow tagging routes to influence the on-premises router's preference.

Why this answer

BGP communities allow you to tag routes on the Direct Connect VIFs with specific community values (e.g., 7224:7100 for the primary VIF, 7224:7200 for the secondary VIF). AWS Direct Connect uses these community tags to influence route preference, ensuring that traffic from on-premises to the VPCs consistently uses the designated primary VIF. This mechanism provides granular control over path selection without modifying AS_PATH or local preference, directly addressing asymmetric routing.

Exam trap

The trap here is that candidates confuse AS_PATH prepending (which affects outbound traffic from AWS) with BGP communities (which can influence inbound traffic from on-premises), leading them to select Option A despite it solving the wrong direction of traffic flow.

How to eliminate wrong answers

Option A is wrong because AS_PATH prepending influences outbound route advertisement from AWS to on-premises, not inbound traffic direction; it makes a path less preferred for traffic leaving AWS, but the question requires controlling traffic from on-premises to VPCs. Option B is wrong because enabling Jumbo Frames increases the Maximum Transmission Unit (MTU) for better throughput but has no effect on routing decisions or path selection to resolve asymmetric routing. Option C is wrong because the Local Preference attribute is used within an AS to influence outbound traffic from that AS; AWS does not allow customers to set Local Preference on the AWS side of a Direct Connect VIF, and it would not control inbound traffic from on-premises.

Practice this question →

391

MCQmedium

Refer to the exhibit. A company has an S3 bucket with the bucket policy shown. An EC2 instance in a VPC with CIDR 10.0.0.0/16 tries to retrieve an object from the bucket using the S3 console, but receives an 'Access Denied' error. The instance's security group allows all outbound traffic. What is the most likely cause?

A.The EC2 instance is accessing the S3 bucket through a NAT Gateway, so the source IP is the public IP of the NAT Gateway, which does not match the condition.

B.The bucket policy does not allow the s3:GetObject action.

C.The bucket policy does not specify a principal, so it defaults to deny.

D.The condition aws:SourceIp is too restrictive and blocks all traffic.

AnswerA

The IP condition requires the source IP to be within the VPC CIDR, but via NAT the source IP is the NAT's public IP.

Why this answer

The bucket policy uses the `aws:SourceIp` condition to restrict access to requests originating from the specific IP range 10.0.0.0/16. However, when the EC2 instance accesses S3 through a NAT Gateway, the source IP seen by S3 is the public IP of the NAT Gateway, not the private IP of the instance. Since the NAT Gateway's public IP does not fall within the 10.0.0.0/16 range, the condition fails and S3 returns an 'Access Denied' error.

Exam trap

The ANS-C01 exam often tests the misconception that the `aws:SourceIp` condition evaluates the private IP of the EC2 instance, when in reality it evaluates the source IP of the IP packet as seen by S3, which after NAT is the public IP of the NAT Gateway.

How to eliminate wrong answers

Option B is wrong because the bucket policy explicitly includes the `s3:GetObject` action in the `Action` element, so the action is allowed. Option C is wrong because the bucket policy does specify a principal — it uses `"Principal": "*"`, which grants access to all principals, so the policy is not defaulting to deny. Option D is wrong because the `aws:SourceIp` condition is not too restrictive in general; it correctly restricts to the 10.0.0.0/16 range, but the issue is that the source IP seen by S3 is the NAT Gateway's public IP, not a private IP in that range.

Practice this question →

392

MCQmedium

A company is designing a network for a multi-tier application that includes a web tier, application tier, and database tier. The web tier must be accessible from the internet, while the application and database tiers should have no direct internet access. All tiers are in the same VPC. Which configuration meets these requirements?

A.Place all tiers in public subnets and use security group rules to restrict access to app and DB tiers

B.Place web tier in public subnets with Internet Gateway, app and DB tiers in private subnets with a NAT Gateway for outbound traffic

C.Place web tier in a public subnet and app and DB tiers in the same public subnet but with restrictive Network ACLs

D.Place all tiers in private subnets and attach an Internet Gateway to the private subnets for the web tier

AnswerB

This design provides internet access to web tier while isolating app and DB tiers.

Why this answer

It places the web tier in a public subnet with an Internet Gateway (IGW) for direct inbound internet traffic, while the application and database tiers reside in private subnets with no direct internet path. A NAT Gateway in a public subnet provides outbound-only internet access for the private tiers (e.g., for software updates) without allowing inbound connections, satisfying the requirement that only the web tier be internet-accessible.

Exam trap

The ANS-C01 exam often tests the misconception that security groups or NACLs alone can fully isolate tiers from the internet when placed in public subnets, ignoring that a public subnet’s route to an Internet Gateway inherently allows inbound traffic unless explicitly blocked by a firewall or stateful inspection.

How to eliminate wrong answers

Option A is wrong because placing all tiers in public subnets exposes the application and database tiers to the internet; security group rules alone cannot prevent direct inbound traffic from the internet if the subnets have a route to an Internet Gateway. Option C is wrong because placing all tiers in the same public subnet with restrictive Network ACLs still allows inbound internet traffic to the application and database tiers (since the subnet is public), and NACLs are stateless, requiring complex bidirectional rules that are error-prone and do not provide the same isolation as private subnets. Option D is wrong because attaching an Internet Gateway to private subnets makes them public; private subnets by definition have no direct route to an IGW, and doing so would expose all tiers to the internet, violating the requirement.

Practice this question →

393

Multi-Selecteasy

Which TWO of the following are valid methods to connect a VPC to an on-premises network? (Choose TWO.)

Select 2 answers

A.AWS Site-to-Site VPN

B.AWS Direct Connect

C.VPC endpoints

D.AWS Transit Gateway

E.VPC peering

AnswersA, B

Creates a secure connection over the internet.

Why this answer

AWS Site-to-Site VPN creates an encrypted tunnel over the public internet between a VPC and an on-premises network using IPsec. It is a fully managed, quick-to-deploy method that supports both static routes and BGP dynamic routing via the virtual private gateway.

Exam trap

The trap here is that candidates confuse AWS Transit Gateway as a direct connection method to on-premises, when it is actually a central hub that requires a VPN or Direct Connect attachment to reach on-premises networks.

Practice this question →

394

Multi-Selecthard

Which THREE of the following are considerations when designing a multi-account VPC architecture using AWS Transit Gateway? (Choose 3.)

Select 3 answers

A.Transit Gateway can be integrated with Direct Connect Gateway

B.Each VPC must have a unique route table

C.Transit Gateway supports cross-account VPC attachments

D.Route tables can be used to isolate VPCs from each other

E.VPCs with overlapping CIDR blocks can be attached

AnswersA, C, D

Direct Connect Gateway can connect to Transit Gateway.

Why this answer

AWS Transit Gateway acts as a central hub for interconnecting VPCs and on-premises networks. It can be integrated with Direct Connect Gateway, allowing a single Direct Connect connection to reach multiple VPCs attached to the Transit Gateway, simplifying hybrid network design and reducing operational overhead.

Exam trap

AWS often tests the misconception that each VPC must have its own route table in Transit Gateway, but in reality, multiple VPCs can share a single route table for simplified management, and overlapping CIDRs are explicitly unsupported.

Practice this question →

395

MCQmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to ensure that traffic to S3 does not traverse the internet. Which solution should a network engineer implement?

A.Create a VPC interface endpoint for S3 and attach it to the private subnet.

B.Deploy an S3 VPN endpoint in the VPC.

C.Create a VPC gateway endpoint for S3 and add a route to the S3 prefix list via the endpoint.

D.Set up a NAT gateway in the public subnet and add a route to the S3 prefix list via the NAT gateway.

AnswerC

Gateway endpoints provide private connectivity to S3.

Why this answer

A VPC gateway endpoint for S3 allows instances in a private subnet to access S3 privately using AWS's internal network, without traversing the internet. By adding a route to the S3 prefix list via the gateway endpoint, traffic destined for S3 is directed through the endpoint, which uses AWS's private backbone. This solution is cost-effective and does not require a NAT gateway or internet gateway.

Exam trap

The ANS-C01 exam often tests the distinction between gateway endpoints and interface endpoints for AWS services, and the trap here is that candidates may incorrectly assume S3 supports interface endpoints (like it does for other services such as DynamoDB or API Gateway) or that a NAT gateway is required for private subnet outbound traffic, when a gateway endpoint is the correct and more efficient choice for S3.

How to eliminate wrong answers

Option A is wrong because a VPC interface endpoint for S3 is not supported; S3 only supports gateway endpoints (and interface endpoints for S3 on AWS Outposts, but not in standard VPCs). Option B is wrong because there is no such thing as an 'S3 VPN endpoint'; VPN endpoints are used for Site-to-Site VPN connections, not for direct S3 access. Option D is wrong because a NAT gateway would route traffic to S3 over the internet, which violates the requirement that traffic not traverse the internet, and it also incurs additional costs.

Practice this question →

396

MCQmedium

A company is deploying a VPC with public and private subnets across two Availability Zones. They need to ensure that instances in the private subnets can access the internet for software updates without being directly reachable from the internet. Which AWS service should they use?

A.Virtual Private Gateway

B.VPC Peering Connection

C.Internet Gateway

D.NAT Gateway

AnswerD

A NAT Gateway allows outbound internet traffic from private subnets while blocking inbound traffic.

Why this answer

A NAT Gateway enables instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It translates the private IP addresses of the instances to the NAT Gateway's Elastic IP address using source network address translation (SNAT). This satisfies the requirement of internet access without direct reachability.

Exam trap

The ANS-C01 exam often tests the misconception that an Internet Gateway can be used for private subnets by simply not assigning public IPs, but the trap here is that an Internet Gateway requires instances to have public IP addresses or Elastic IPs for outbound traffic, which still makes them potentially reachable from the internet if routes are misconfigured.

How to eliminate wrong answers

Option A is wrong because a Virtual Private Gateway is used to connect a VPC to an on-premises network via VPN or AWS Direct Connect, not to provide internet access to private instances. Option B is wrong because VPC Peering Connection allows routing between two VPCs using private IP addresses but does not provide internet access. Option C is wrong because an Internet Gateway enables both inbound and outbound internet access for instances with public IP addresses; attaching it to private subnets would make instances directly reachable from the internet, violating the requirement.

Practice this question →

397

MCQeasy

A company has multiple VPCs that need to communicate with each other using private IP addresses. The VPCs are in the same AWS account and Region. Which AWS service provides the simplest and most scalable solution?

A.VPC peering connections

B.AWS Site-to-Site VPN

C.ClassicLink

D.AWS Transit Gateway

AnswerA

Simple, direct, scalable for multiple VPCs.

Why this answer

VPC peering connections allow direct, private IP connectivity between VPCs using the AWS global network, with no single point of failure or bandwidth bottleneck. It is the simplest solution because it requires no additional hardware or software, and it scales horizontally by adding more peering connections as needed, though it does not support transitive routing.

Exam trap

The trap here is that candidates may choose AWS Transit Gateway (Option D) because it is a powerful hub-and-spoke solution, but the question asks for the 'simplest and most scalable' solution for multiple VPCs in the same account and Region, and VPC peering is simpler for small numbers of VPCs, while Transit Gateway adds unnecessary complexity and cost for this specific scenario.

How to eliminate wrong answers

Option B is wrong because AWS Site-to-Site VPN is designed for connecting on-premises networks to AWS, not for inter-VPC communication, and it introduces complexity with VPN tunnels and potential bandwidth limitations. Option C is wrong because ClassicLink is a legacy feature that only connects EC2-Classic instances to a single VPC, not multiple VPCs, and it is not scalable or supported for modern VPC-only architectures. Option D is wrong because AWS Transit Gateway, while scalable and supporting transitive routing, is more complex and costly than VPC peering for a simple scenario with a small number of VPCs in the same account and Region; it is overkill when direct peering suffices.

Practice this question →

398

MCQeasy

A company is deploying a VPC with public and private subnets in two Availability Zones. They need to ensure that instances in private subnets can access the internet for software updates while remaining unreachable from the internet. Which solution meets these requirements?

A.Attach an internet gateway to the private subnets and configure route tables.

B.Deploy a NAT Gateway in a public subnet and add a route to the NAT Gateway in the private subnet route tables.

C.Use a transit gateway to connect the VPC to the internet.

D.Establish a VPN connection to an on-premises network and route traffic through it.

AnswerB

NAT Gateway enables outbound internet connectivity while preventing inbound traffic from the internet.

Why this answer

A NAT Gateway deployed in a public subnet provides outbound-only internet access for instances in private subnets. The private subnet route table directs 0.0.0.0/0 traffic to the NAT Gateway, which translates the private IPs to the NAT Gateway's Elastic IP, allowing internet access while preventing any unsolicited inbound connections from the internet.

Exam trap

AWS often tests the misconception that an internet gateway can be directly associated with private subnets, but the trap here is that an internet gateway enables bidirectional traffic, so attaching it to private subnets would expose instances to inbound internet connections, violating the requirement for unreachability from the internet.

How to eliminate wrong answers

Option A is wrong because an internet gateway (IGW) must be attached to the VPC, not to subnets, and adding a route to an IGW in private subnet route tables would make those subnets effectively public, allowing inbound traffic from the internet, which violates the requirement that instances remain unreachable from the internet. Option C is wrong because a transit gateway is used for inter-VPC or hybrid connectivity, not for providing direct internet access to VPC resources; it does not replace the need for a NAT device or internet gateway for internet-bound traffic. Option D is wrong because a VPN connection to an on-premises network routes traffic through a corporate network, which may not provide direct internet access for software updates and introduces unnecessary latency and complexity; it does not satisfy the requirement for instances to access the internet directly.

Practice this question →

399

MCQmedium

Refer to the exhibit. After deploying this CloudFormation stack, the VPC is attached to the transit gateway. However, routes are not being propagated to the transit gateway route table. What is the most likely cause?

A.The VPC attachment is not in the 'available' state.

B.The transit gateway route table propagation is not configured.

C.VPN ECMP support is enabled, preventing propagation.

D.DNS support is disabled on the transit gateway.

AnswerB

DefaultRouteTablePropagation enables automatic propagation, but the attachment does not explicitly propagate.

Why this answer

The exhibit shows a transit gateway route table attached to the VPC, but no propagation is configured. Without explicit propagation, the VPC attachment's CIDR blocks are not automatically added to the transit gateway route table. The CloudFormation resource AWS::EC2::TransitGatewayRouteTablePropagation must be declared to enable route propagation from the VPC attachment into the transit gateway route table.

Exam trap

The ANS-C01 exam often tests the distinction between transit gateway attachment and route propagation, trapping candidates who assume that simply attaching a VPC to a transit gateway automatically populates the route table with the VPC's CIDR.

How to eliminate wrong answers

Option A is wrong because if the VPC attachment were not in the 'available' state, the attachment would fail entirely or be in a 'pending' or 'failed' state, which would prevent any route propagation, but the question states the VPC is attached to the transit gateway, implying the attachment is available. Option C is wrong because VPN ECMP support is a feature for VPN attachments that allows equal-cost multipath routing across multiple VPN tunnels; it does not affect route propagation from a VPC attachment to the transit gateway route table. Option D is wrong because DNS support is a VPC-level setting (enableDnsSupport) that controls DNS resolution within the VPC and has no impact on transit gateway route propagation.

Practice this question →

400

Multi-Selecthard

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 172.16.0.0/12. They are using an AWS Transit Gateway with a VPN attachment to the on-premises network. The transit gateway route table has a static route for 172.16.0.0/12 pointing to the VPN attachment. Which THREE of the following are necessary for traffic to flow from the VPC to on-premises?

Select 3 answers

A.The VPC route tables include a route for 172.16.0.0/12 pointing to the transit gateway

B.The VPC is attached to the transit gateway

C.The transit gateway route table includes a route for 172.16.0.0/12 pointing to the VPN attachment

D.The on-premises router is advertising the 172.16.0.0/12 route over BGP

E.The VPN tunnel is configured with dynamic BGP routing

AnswersA, B, C

VPC instances need a route to send traffic to the transit gateway.

Why this answer

Necessary because the VPC route tables must have a route for 172.16.0.0/12 pointing to the transit gateway to forward traffic to on-premises. Option B is necessary because the VPC must be attached to the transit gateway to allow communication. Option C is necessary because the transit gateway route table must include a static route for 172.16.0.0/12 pointing to the VPN attachment.

Option D is not necessary because the on-premises router does not need to advertise the route over BGP; the static route in the transit gateway suffices. Option E is not necessary because the VPN tunnel can use static routing instead of dynamic BGP.

Practice this question →

401

MCQmedium

A company has a VPC with public and private subnets in multiple Availability Zones. They want to deploy a NAT gateway for outbound internet access for instances in private subnets. Which of the following is the most highly available architecture?

A.Deploy one NAT gateway in each Availability Zone with a route table per AZ that points to the NAT gateway in the same AZ.

B.Deploy one NAT gateway in the first Availability Zone and route all private subnet traffic to that NAT gateway.

C.Use a single NAT instance in a public subnet with an auto scaling group and health checks.

D.Deploy two NAT gateways in the first Availability Zone and use a single route table pointing to one of them.

AnswerA

This provides per-AZ redundancy and avoids cross-AZ dependency.

Why this answer

For high availability, you should deploy a NAT gateway in each Availability Zone and route traffic from private subnets in each AZ to the NAT gateway in the same AZ. This avoids cross-AZ data transfer costs and ensures that an AZ failure does not affect other AZs. Option A is correct.

Options B and C do not provide equal HA. Option D is incorrect because deploying both NAT gateways in the same Availability Zone creates a single point of failure—if that AZ goes down, both gateways fail, so it is not highly available.

Practice this question →

402

MCQmedium

A company is deploying a hybrid network architecture with an AWS Direct Connect connection. They require high availability with redundant connections to two different AWS Direct Connect locations. Which configuration meets the high availability requirement?

A.Two Direct Connect connections at two different AWS Direct Connect locations

B.One Direct Connect connection and one AWS Site-to-Site VPN as backup

C.Two virtual interfaces (VIFs) on the same Direct Connect connection

D.Two Direct Connect connections at the same AWS Direct Connect location

AnswerA

Provides physical redundancy and high availability.

Why this answer

Deploying two Direct Connect connections at two different AWS Direct Connect locations provides physical and logical redundancy. This ensures that if one location experiences an outage, the other location can continue to handle traffic, meeting the high availability requirement. AWS recommends this architecture for production workloads requiring resilient hybrid connectivity.

Exam trap

The trap here is that candidates often confuse multiple virtual interfaces (VIFs) or multiple connections at the same location as sufficient redundancy, but AWS explicitly requires connections at two different Direct Connect locations to achieve true high availability against facility-level failures.

How to eliminate wrong answers

Option B is wrong because a Site-to-Site VPN over the internet is not a fully redundant alternative to a second Direct Connect connection; it introduces higher latency, lower bandwidth, and dependency on internet availability, which does not meet the same high availability SLA as dual Direct Connect connections. Option C is wrong because two virtual interfaces on the same Direct Connect connection share the same physical infrastructure; a single fiber cut or device failure at that location will bring down both VIFs, providing no redundancy. Option D is wrong because two Direct Connect connections at the same AWS Direct Connect location still share the same facility and potential single points of failure (e.g., power, cooling, or carrier issues), so they do not achieve the required high availability across independent failure domains.

Practice this question →

403

Multi-Selecteasy

A company is setting up a site-to-site VPN connection between an on-premises network and AWS. Which TWO components are required for the VPN connection?

Select 2 answers

A.Customer gateway

B.Transit gateway

C.Virtual private gateway

D.VPN connection

E.Direct Connect connection

AnswersA, C

Represents the on-premises router.

Why this answer

A customer gateway is required as the on-premises side endpoint for the site-to-site VPN, representing the physical or software VPN device on the customer network. A virtual private gateway is required as the AWS-side VPN concentrator that terminates the VPN tunnels and routes traffic from the VPC to the on-premises network. Together, they form the two mandatory endpoints for establishing IPsec VPN tunnels over the internet.

Exam trap

The ANS-C01 exam often tests the misconception that the VPN connection resource itself is a required component, but it is actually the logical configuration object that links the two endpoints, not a physical or virtual endpoint required for the VPN to function.

Practice this question →

404

MCQmedium

A company has a VPC with an Application Load Balancer (ALB) that distributes traffic to EC2 instances in private subnets. The ALB needs to be accessible from the internet. The security team requires that all traffic to the ALB be inspected by AWS WAF. Which configuration meets these requirements?

A.Associate AWS WAF with the ALB and make the ALB internet-facing

B.Use a Network Load Balancer with AWS WAF attached

C.Place the ALB behind a Security Group that inspects traffic

D.Use Amazon CloudFront in front of the ALB with AWS WAF

AnswerA

ALB supports AWS WAF integration for web traffic inspection.

Why this answer

AWS WAF can be directly associated with an Application Load Balancer (ALB) to inspect HTTP/HTTPS traffic before it reaches the ALB. Making the ALB internet-facing allows it to receive traffic directly from the internet while WAF provides the required traffic inspection. This combination meets both the accessibility and security requirements without additional components.

Exam trap

The trap here is that candidates may think CloudFront is always required for WAF integration, but AWS WAF can be directly associated with an internet-facing ALB without needing CloudFront.

How to eliminate wrong answers

Option B is wrong because AWS WAF cannot be directly attached to a Network Load Balancer (NLB); WAF only supports ALBs, API Gateway, CloudFront, and AppSync. Option C is wrong because a Security Group acts as a stateful firewall filtering traffic based on IP addresses and ports, but it does not perform application-layer inspection like WAF (e.g., SQL injection or XSS detection). Option D is wrong because while CloudFront with WAF can inspect traffic, it introduces an additional CDN layer that is not required by the question; the ALB itself can be directly associated with WAF without CloudFront.

Practice this question →

405

MCQeasy

A company is deploying a web application in a VPC with an Application Load Balancer (ALB) in front of EC2 instances. The ALB must only accept traffic from the internet and forward it to the instances. Which subnet configuration is correct for the ALB and EC2 instances?

A.ALB in private subnets, EC2 in private subnets with a NAT gateway.

B.ALB in public subnets, EC2 in private subnets.

C.ALB in public subnets, EC2 in public subnets.

D.ALB in private subnets, EC2 in public subnets.

AnswerB

Standard architecture for internet-facing ALB.

Why this answer

An Application Load Balancer (ALB) must be deployed in public subnets to accept traffic directly from the internet, as it requires an internet gateway (IGW) route to receive inbound connections. The EC2 instances should reside in private subnets to enhance security, as they only need to respond to the ALB via the VPC's internal routing, not directly from the internet. This configuration ensures the ALB handles internet-facing traffic while the instances remain isolated from direct external access.

Exam trap

The trap here is that candidates often assume both the ALB and EC2 instances must be in the same subnet type (both public or both private), failing to recognize that the ALB acts as a reverse proxy that can bridge internet-facing public subnets with backend private subnets.

How to eliminate wrong answers

Option A is wrong because placing the ALB in private subnets prevents it from receiving internet traffic, as private subnets lack a direct route to an internet gateway, and a NAT gateway is used for outbound-only traffic, not inbound. Option C is wrong because placing EC2 instances in public subnets exposes them directly to the internet, bypassing the ALB's security benefits and violating the requirement that the ALB must forward traffic to instances. Option D is wrong because the ALB in private subnets cannot accept internet traffic, and placing EC2 instances in public subnets unnecessarily exposes them to the internet, defeating the purpose of using an ALB for controlled traffic flow.

Practice this question →

406

MCQmedium

A company is deploying a fleet of EC2 instances in private subnets. The instances need to download patches from the internet. The company wants to minimize cost and avoid managing NAT instances. The VPC has an internet gateway (IGW) attached. What should the company do?

A.Attach the IGW to the private subnet route table.

B.Deploy a NAT Gateway in a public subnet and update the private subnet route tables.

C.Create a VPC endpoint for internet access.

D.Launch a NAT instance and configure routing.

AnswerB

Managed, cost-effective, provides internet access to private instances.

Why this answer

A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in private subnets to initiate outbound traffic to the internet (e.g., for patch downloads) while preventing inbound connections from the internet. This solution is fully managed by AWS, eliminating the need to manage a NAT instance, and it is cost-effective compared to maintaining a dedicated instance. The private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway ID.

Exam trap

The trap here is that candidates often confuse an Internet Gateway with a NAT Gateway, assuming that simply attaching an IGW to a private subnet route table will provide internet access, but an IGW alone cannot perform SNAT for private IP addresses.

How to eliminate wrong answers

Option A is wrong because attaching an IGW directly to a private subnet route table would not work; an IGW requires a public IP address on the instance to function, and private subnets do not have a route to the IGW for outbound-only traffic. Option C is wrong because a VPC endpoint (e.g., Gateway or Interface endpoint) provides private connectivity to specific AWS services (like S3 or DynamoDB) via the AWS network, not general internet access for downloading arbitrary patches from the internet. Option D is wrong because while a NAT instance could work, it requires manual management, patching, and high-availability configuration, contradicting the requirement to 'avoid managing NAT instances' and minimize cost.

Practice this question →

407

MCQhard

A company has a centralized inspection VPC architecture where all traffic from spoke VPCs is routed through a Transit Gateway to a centralized VPC that hosts firewall appliances (NGFW). The company needs to inspect traffic between two instances in the same spoke VPC. What is the simplest way to achieve this?

A.Deploy a Gateway Load Balancer (GWLB) in the spoke VPC and route traffic to it.

B.Use AWS Transit Gateway with VPC attachments and configure route tables to force traffic between the two instances through the inspection VPC.

C.Enable VPC peering and use route propagation to send traffic to the inspection VPC.

D.Create a VPC peering connection between the two instances' VPCs.

AnswerB

Transit Gateway can be configured with route tables that send inter-VPC traffic to the inspection VPC for firewall inspection.

Why this answer

AWS Transit Gateway can route traffic between instances in the same spoke VPC by using VPC attachments and route tables to force the traffic through the centralized inspection VPC. This is achieved by configuring the spoke VPC's route table to send inter-instance traffic to the Transit Gateway, which then forwards it to the inspection VPC for firewall inspection before returning it to the destination instance. This approach avoids the need for additional appliances or complex routing within the spoke VPC itself.

Exam trap

AWS often tests the misconception that VPC peering can be used for transitive routing or that a Gateway Load Balancer alone can redirect traffic within the same VPC, but the key trap here is that candidates overlook the Transit Gateway's ability to hairpin traffic from the same spoke VPC through a central inspection VPC using proper route table configurations.

How to eliminate wrong answers

Option A is wrong because a Gateway Load Balancer (GWLB) is used for scaling and distributing traffic to third-party appliances, but it does not inherently route traffic between instances in the same VPC through a centralized inspection VPC; it would require additional routing configurations and does not leverage the existing Transit Gateway architecture. Option C is wrong because VPC peering does not support transitive routing; even with route propagation, traffic between two instances in the same spoke VPC cannot be forced through a separate inspection VPC via VPC peering, as peering connections are point-to-point and do not allow intermediate hops. Option D is wrong because creating a VPC peering connection between the two instances' VPCs is irrelevant when both instances are in the same spoke VPC, and it does not provide a path to the centralized inspection VPC.

Practice this question →

408

MCQhard

Refer to the exhibit. A company has two VPCs (vpc-aaaaaaaa and vpc-bbbbbbbb) that are peered. The CIDR blocks are both 10.0.0.0/16. The peering connection status is 'active'. Which of the following is true about this configuration?

A.The VPCs cannot communicate because of overlapping CIDR blocks

B.The VPC peering connection will not become active due to overlapping CIDRs

C.The VPCs can communicate using the peering connection without any issues

D.DNS resolution between the VPCs will be automatically enabled

AnswerA

Overlapping CIDRs prevent proper routing.

Why this answer

VPC peering does not support overlapping CIDR blocks. Even though the peering connection status is active, routes cannot be added to the route tables because the CIDR blocks are identical (both 10.0.0.0/16), preventing communication. Option B is incorrect because the peering connection can become active despite overlapping CIDRs; the issue arises at the routing layer.

Option C is incorrect because the overlapping CIDRs prevent any communication between the VPCs. Option D is incorrect because DNS resolution is not automatically enabled; it requires additional configuration.

Practice this question →

409

MCQhard

A company has deployed a multi-account AWS environment using AWS Organizations. Each account has one or more VPCs that need to communicate with each other and with an on-premises data center via a central transit VPC. The company uses AWS Transit Gateway with a centralized network account that hosts the Transit Gateway. VPCs from other accounts are attached to the Transit Gateway via Resource Access Manager (RAM) shares. The network team notices that after attaching a new VPC from a member account, resources in that VPC cannot communicate with resources in other attached VPCs. The Transit Gateway route tables have appropriate routes, and the VPC route tables point to the Transit Gateway. What is the MOST likely cause of the issue?

A.The Transit Gateway attachment in the member account is in the 'pending acceptance' state and not yet accepted by the Transit Gateway owner.

B.The Transit Gateway route table does not have the routes from the new VPC propagated.

C.The new VPC's CIDR overlaps with an existing attachment's CIDR.

D.The member account's VPC does not have a route to the Transit Gateway in its route tables.

AnswerA

The owner must accept the attachment for it to be active.

Why this answer

When a Transit Gateway attachment is shared via AWS Resource Access Manager (RAM), the attachment must be accepted by the Transit Gateway owner in the central network account. Until acceptance, the attachment remains in a 'pending acceptance' state, and traffic cannot flow through it. Since the problem states that route tables are correctly configured and VPC routes point to the Transit Gateway, the most likely cause is that the new VPC's attachment has not yet been accepted, which corresponds to option A.

Practice this question →

410

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Site-to-Site VPN. The on-premises network uses 10.0.0.0/8. The company wants to ensure that traffic to on-premises from VPC does not overlap with VPC's own CIDR. Which action should be taken?

A.Change the VPC CIDR to a non-overlapping range such as 172.16.0.0/16.

B.Create a more specific route in the VPC route table for the on-premises network that is within the 10.0.0.0/8 range but not overlapping with the VPC's subnets.

C.Use a NAT gateway to translate the VPC's IP addresses to a different IP range when communicating with on-premises.

D.Use AWS Transit Gateway with a network overlay to encapsulate traffic.

AnswerB

More specific routes take precedence, so traffic to specific on-premises prefixes will go via VPN even if the VPC CIDR is a superset.

Why this answer

Creating a more specific route (e.g., 10.0.0.0/8 with a longer prefix than the VPC's /16) in the VPC route table allows traffic destined for the on-premises network to be directed through the VPN, while the VPC's own /16 CIDR remains local. AWS uses the most specific route that matches the destination IP, so a route with a longer prefix (e.g., /8) will not override the local /16 route for VPC-internal traffic, preventing overlap.

Exam trap

The trap here is that candidates assume overlapping CIDRs are impossible to route and immediately choose to change the VPC CIDR (Option A), but AWS allows overlapping ranges as long as more specific routes are used to direct traffic correctly.

How to eliminate wrong answers

Option A is wrong because changing the VPC CIDR to 172.16.0.0/16 is unnecessary and disruptive; the problem can be solved with routing without re-architecting the VPC. Option C is wrong because a NAT gateway translates source IPs for outbound traffic to the internet, not for Site-to-Site VPN traffic to on-premises; it cannot resolve overlapping CIDR issues in this context. Option D is wrong because AWS Transit Gateway with a network overlay (e.g., GRE or IPsec) adds complexity and cost but does not inherently solve the overlapping CIDR problem; the core issue is route table priority, which is handled by more specific routes.

Practice this question →

411

Multi-Selecthard

Which THREE of the following are required to configure a site-to-site VPN connection between an on-premises network and an Amazon VPC? (Select THREE.)

Select 3 answers

A.A customer gateway resource representing the on-premises VPN device.

B.A public virtual interface.

C.A virtual private gateway or transit gateway attached to the VPC.

D.An AWS Direct Connect connection.

E.Two VPN tunnels for high availability.

AnswersA, C, E

Defines the on-premises endpoint.

Why this answer

A customer gateway resource is required because it represents the on-premises VPN device in AWS, providing the necessary configuration information such as the device's public IP address and BGP ASN (if dynamic routing is used) to establish the site-to-site VPN connection. Without this resource, AWS has no reference to the remote endpoint for the IPsec tunnels.

Exam trap

The trap here is that candidates often confuse the requirements for a site-to-site VPN with those for AWS Direct Connect, mistakenly selecting a public virtual interface or Direct Connect connection as necessary components when they are actually part of a separate hybrid connectivity solution.

Practice this question →

412

MCQeasy

A company wants to connect its on-premises data center to a VPC using AWS Site-to-Site VPN. Which of the following is required to establish the VPN connection?

A.Direct Connect gateway associated with the VPC

B.Internet gateway attached to the VPC

C.Virtual private gateway attached to the VPC and a customer gateway representing the on-premises router

D.VPC endpoint for the VPN service

AnswerC

A virtual private gateway is the AWS-side VPN endpoint, and a customer gateway represents the on-premises device.

Why this answer

To establish a Site-to-Site VPN, you need a virtual private gateway (VGW) or transit gateway on the AWS side, and a customer gateway (CGW) representing the on-premises router. Option C is correct. Option A is incorrect because a Direct Connect gateway is used for Direct Connect connections, not VPN.

Option B is incorrect because an internet gateway is used for public internet traffic, not VPN. Option D is incorrect because a VPC endpoint is for private access to AWS services, not for establishing a VPN connection.

Practice this question →

413

MCQmedium

A company has set up a site-to-site VPN connection between its on-premises network and AWS. The tunnel status shows 'UP' on both sides, but traffic from on-premises cannot reach EC2 instances in the VPC. What is the most likely cause?

A.The pre-shared keys are mismatched.

B.The VPC route tables do not have a route pointing to the virtual private gateway for the on-premises CIDR.

C.The VPN tunnel has been idle for too long and needs to be re-initiated.

D.The security group associated with the EC2 instances does not allow inbound traffic from the VPN gateway.

AnswerB

Without a route to the virtual private gateway, traffic from the VPC to on-premises will not be forwarded.

Why this answer

The most likely cause is that the VPC route tables lack a route pointing to the virtual private gateway (VGW) for the on-premises CIDR. Even though the VPN tunnel is UP (indicating Phase 1 and Phase 2 IPsec SAs are established), traffic from on-premises cannot reach EC2 instances if the VPC does not know how to forward return traffic back through the VGW. Without this route, the VPC drops inbound packets or sends them to the internet gateway instead of the VPN tunnel.

Exam trap

The trap here is that candidates see 'tunnel status UP' and assume routing is automatically configured, but AWS requires explicit route table entries for the VPC to forward traffic to the VGW, and the exam tests this separation of control plane (tunnel) and data plane (routing).

How to eliminate wrong answers

Option A is wrong because mismatched pre-shared keys would prevent the IPsec tunnel from establishing, resulting in a DOWN status on both sides, not UP. Option C is wrong because VPN tunnels using IPsec with dead peer detection (DPD) do not require re-initiation due to idleness; the tunnel remains UP as long as DPD keepalives are exchanged, and traffic can flow immediately. Option D is wrong because security groups are stateful and automatically allow return traffic for established connections; if the tunnel is UP and routes are correct, inbound traffic from the VPN gateway would be permitted by default, and a security group rule is not needed for the initial inbound packet from on-premises.

Practice this question →

414

MCQmedium

A company has a VPC with multiple subnets across three Availability Zones. The company wants to deploy a Network Load Balancer (NLB) to distribute TCP traffic to a fleet of EC2 instances. The NLB must preserve the source IP address of the client. Which configuration is required?

A.Enable Proxy Protocol v2 on the NLB target group.

B.Enable cross-zone load balancing on the NLB.

C.Attach a security group to the NLB that allows inbound traffic from the client IP range.

D.Create the NLB with a TCP listener and register the EC2 instances as targets in a target group.

AnswerD

NLB preserves source IP for TCP traffic when targets are instances.

Why this answer

Network Load Balancers (NLBs) preserve the source IP address of clients by default when using a TCP listener. No additional configuration is required to enable this behavior; the NLB forwards packets with the original source IP intact. Therefore, simply creating the NLB with a TCP listener and registering EC2 instances as targets is sufficient.

Exam trap

The ANS-C01 exam often tests the misconception that Proxy Protocol v2 must be enabled for source IP preservation on an NLB, when in fact NLBs preserve the source IP by default and Proxy Protocol is only needed for ALBs or when additional metadata is required.

How to eliminate wrong answers

Option A is wrong because Proxy Protocol v2 is an optional header that adds client connection information (including source IP) to the TCP stream, but it is not required for source IP preservation in an NLB; NLBs preserve the source IP natively without Proxy Protocol. Option B is wrong because cross-zone load balancing distributes traffic across targets in multiple Availability Zones but does not affect source IP preservation. Option C is wrong because NLBs do not use security groups; security groups are applied at the instance level, not to the NLB itself, and NLBs are not stateful firewall devices that inspect inbound traffic based on security groups.

Practice this question →

415

MCQhard

A company is implementing a multicast application in AWS. The application requires that multicast traffic be forwarded between Amazon EC2 instances in different VPCs. The company has set up a multicast domain using AWS Transit Gateway Connect with multicast support. The multicast group is using the IP address 239.0.1.10. The network engineer has confirmed that the EC2 instances are registered as multicast members and that the Transit Gateway multicast domain is configured correctly. However, receivers in VPC B are not receiving multicast traffic from senders in VPC A. What is the MOST likely cause of this issue?

A.The multicast group is not associated with the correct subnet in VPC A.

B.The multicast traffic has a TTL value of 1, which prevents it from leaving the source subnet.

C.The security group for the sender EC2 instances does not allow outbound UDP traffic to the multicast group address.

D.The receiver instances are not sending IGMP join messages to the multicast group.

AnswerC

Security groups control outbound traffic; if outbound rule missing, traffic is dropped.

Why this answer

The issue is that the sender EC2 instances' security group must allow outbound UDP traffic to the multicast group address 239.0.1.10. Even though the Transit Gateway multicast domain is correctly configured, security groups act as a virtual firewall at the instance level and can block multicast traffic if the appropriate outbound rule is not present. Option C is correct because without this rule, the traffic is blocked at the source.

Option A is incorrect because multicast groups are not tied to specific subnets; they are associated with the transit gateway. Option B is incorrect because TTL is not a limiting factor in this scenario; AWS Transit Gateway multicast handles traffic within the domain regardless of TTL. Option D is incorrect because IGMP join messages are not required; multicast group members are statically registered in the Transit Gateway multicast domain.

Practice this question →

416

Multi-Selecteasy

Which TWO of the following are true about AWS VPC security groups? (Choose two.)

Select 2 answers

A.Rules are evaluated in order, and the first matching rule is applied.

B.They have an implicit deny all rule at the end.

C.They are stateful, meaning return traffic is automatically allowed regardless of outbound rules.

D.They support both allow and deny rules.

E.They can be associated with subnets.

AnswersB, C

If no rule matches, traffic is denied.

Why this answer

Security groups in AWS VPC are stateful, meaning that if you allow inbound traffic, the corresponding outbound return traffic is automatically permitted, regardless of outbound rules. They also have an implicit deny all rule at the end, so any traffic not explicitly allowed by a rule is denied. This makes options B and C correct.

Exam trap

The ANS-C01 exam often tests the misconception that security groups are stateless like network ACLs, or that they support deny rules, or that they are associated with subnets, leading candidates to confuse security groups with network ACLs.

Practice this question →