Courseiva

CCNA Network Design Questions

75 of 482 questions · Page 4/7 · Network Design topic · Answers revealed

Practice these questionsExam hubAll questions
226
MCQhard

A company is designing a network for a multi-account AWS environment using AWS Organizations. They need to establish a central inspection VPC for traffic inspection using a Gateway Load Balancer (GWLB). Traffic from all other VPCs should be routed through the inspection VPC before reaching the internet or on-premises. Which architecture should be used?

A.Use VPC Peering to connect all VPCs to the inspection VPC and configure routes to the GWLB.
B.Use AWS Direct Connect Gateway to connect all VPCs and route traffic through the inspection VPC.
C.Use AWS Transit Gateway with a centralized inspection VPC that hosts a GWLB. Configure route tables on the Transit Gateway to send traffic to the GWLB endpoint.
D.Use AWS Network Firewall in each VPC and route traffic to it.
AnswerC

Transit Gateway allows transitive routing and can force traffic through the inspection VPC.

Why this answer

AWS Transit Gateway enables centralized routing between multiple VPCs, and when combined with a Gateway Load Balancer (GWLB) in an inspection VPC, it allows traffic from all other VPCs to be forwarded to the GWLB for inspection before reaching the internet or on-premises. Transit Gateway route tables can be configured with static routes pointing to the GWLB endpoint (using Gateway Load Balancer Endpoint service), ensuring all inter-VPC and egress traffic is steered through the inspection VPC. This architecture scales efficiently across many VPCs in an AWS Organizations multi-account setup without requiring complex peering or direct connections.

Exam trap

The trap here is that candidates often confuse VPC Peering's lack of transitive routing with the ability to create a hub-and-spoke model, leading them to select Option A, but AWS explicitly states that VPC Peering does not support transitive routing, making Transit Gateway the only viable option for centralized inspection across multiple VPCs.

How to eliminate wrong answers

Option A is wrong because VPC Peering does not support transitive routing; each peering connection is a one-to-one relationship, so traffic from one VPC cannot be routed through a central inspection VPC to another VPC or to the internet without explicit peering between every pair, making it unscalable and unable to enforce centralized inspection. Option B is wrong because AWS Direct Connect Gateway is used to connect on-premises networks to multiple VPCs via Direct Connect, but it does not provide routing between VPCs themselves or support forwarding traffic through a central inspection VPC; it lacks the transitive routing capability needed for this multi-VPC inspection pattern. Option D is wrong because AWS Network Firewall in each VPC would require deploying and managing separate firewall instances per VPC, which defeats the requirement for a central inspection VPC and does not provide a single point of traffic inspection across all VPCs; it also adds operational overhead and does not leverage the GWLB for centralized traffic steering.

Practice this question →
227
Multi-Selecteasy

A company is designing a VPC with public and private subnets. The company needs to provide internet access to instances in the private subnets. Which TWO components are required? (Choose TWO.)

Select 2 answers
A.Internet Gateway attached to the VPC
B.Transit Gateway
C.NAT Gateway in a public subnet
D.VPC Gateway Endpoint for S3
E.Virtual Private Gateway
AnswersA, C

IGW is needed for public subnet and NAT.

Why this answer

An Internet Gateway (IGW) is required to provide a target in the VPC route tables for internet-bound traffic. For instances in private subnets, a NAT Gateway placed in a public subnet translates their private IP addresses to the public IP of the NAT Gateway, allowing outbound internet access while preventing unsolicited inbound connections. The private subnet's route table must point 0.0.0.0/0 to the NAT Gateway, and the public subnet's route table must point 0.0.0.0/0 to the IGW.

Exam trap

The trap here is that candidates often think a NAT Gateway alone is sufficient, forgetting that an Internet Gateway must be attached to the VPC and the public subnet's route table must point to it for the NAT Gateway to reach the internet.

Practice this question →
228
Multi-Selecthard

A company wants to connect its on-premises data center to AWS using AWS Direct Connect and wants to use the same connection to access multiple VPCs in the same AWS region. The company also needs to maintain private IP connectivity between the VPCs. Which THREE components should the company use to meet these requirements? (Choose three.)

Select 3 answers
A.Transit Gateway VPC attachments
B.VPC peering connections between each VPC
C.AWS Site-to-Site VPN connection
D.AWS Direct Connect gateway
E.AWS Transit Gateway
AnswersA, D, E

Each VPC must be attached to the Transit Gateway to enable connectivity through the Transit Gateway.

Why this answer

Transit Gateway VPC attachments allow multiple VPCs to connect to a central transit gateway, enabling private IP connectivity between them. When combined with an AWS Direct Connect gateway, the on-premises data center can use a single Direct Connect connection to reach all attached VPCs via the transit gateway, meeting both requirements efficiently.

Exam trap

The trap here is that candidates often confuse VPC peering with transit gateway, assuming peering can provide transitive routing or work with a single Direct Connect connection, but AWS explicitly requires a transit gateway for hub-and-spoke connectivity with Direct Connect.

Practice this question →
229
MCQmedium

A company is designing a network for a three-tier web application in AWS. The web tier must be accessible from the internet, but the application and database tiers must be private. The company wants to use a single AWS Region and ensure high availability across multiple Availability Zones. What is the MOST cost-effective network design that meets these requirements?

A.Place web servers in public subnets across three AZs. Place application and database servers in private subnets across three AZs. Use a NAT Gateway in each AZ for outbound traffic.
B.Place web servers in public subnets across three AZs. Place application and database servers in private subnets across three AZs. Use NAT instances in each AZ behind an Auto Scaling group.
C.Place web servers in public subnets and application/database servers in private subnets in one AZ. Use a single NAT Gateway in the public subnet for outbound traffic.
D.Place all tiers in public subnets and use security groups to restrict inbound traffic to the web tier only.
AnswerA

Highly available and cost-effective managed service.

Why this answer

It places web servers in public subnets across three Availability Zones (AZs) for internet-facing access and high availability, while application and database servers reside in private subnets across three AZs for isolation. A NAT Gateway in each AZ provides cost-effective outbound internet connectivity for private instances without exposing them to inbound traffic, and using one NAT Gateway per AZ avoids cross-AZ data transfer charges, which would increase costs if a single NAT Gateway were shared across AZs.

Exam trap

AWS often tests the misconception that a single NAT Gateway is more cost-effective than multiple, but the trap is that cross-AZ data transfer costs from using a single NAT Gateway in a multi-AZ setup can exceed the cost of deploying one NAT Gateway per AZ, making the per-AZ design more cost-effective overall.

How to eliminate wrong answers

Option B is wrong because NAT instances behind an Auto Scaling group introduce management overhead, potential single points of failure during scaling events, and higher operational cost compared to managed NAT Gateways, making it less cost-effective. Option C is wrong because deploying all tiers in a single AZ violates the high availability requirement across multiple Availability Zones, as a single AZ failure would take down the entire application. Option D is wrong because placing all tiers in public subnets exposes application and database servers to the internet, violating the requirement that they remain private, even with security group restrictions, as security groups do not prevent all potential attack vectors like direct IP spoofing or misconfigurations.

Practice this question →
230
MCQmedium

A company has multiple VPCs in the same AWS region that need to communicate with each other. The network team wants to minimize the number of connections and simplify management. The solution must support transitive routing between all VPCs. Which AWS service should be used?

A.VPC Peering
B.AWS Direct Connect Gateway
C.AWS Transit Gateway
D.VPC Endpoints
AnswerC

Correct; Transit Gateway provides transitive routing and simplifies connections.

Why this answer

AWS Transit Gateway (TGW) is a network transit hub that enables transitive routing between multiple VPCs and on-premises networks through a single gateway. It uses a hub-and-spoke architecture, which inherently supports transitive routing (e.g., VPC A can reach VPC C via the TGW without requiring direct peering between A and C). This minimizes the number of connections (N VPCs require only N attachments instead of N*(N-1)/2 VPC peering connections) and simplifies management with a central routing table.

Exam trap

The trap here is that candidates often confuse VPC Peering's lack of transitive routing with the ability to route through a central VPC (e.g., using a third-party appliance), but AWS explicitly prohibits transitive routing through VPC peering, making Transit Gateway the only native service that supports transitive routing between multiple VPCs.

How to eliminate wrong answers

Option A is wrong because VPC Peering does not support transitive routing; traffic cannot flow from VPC A to VPC C through a peering connection with VPC B, as peering is a one-to-one, non-transitive relationship. Option B is wrong because AWS Direct Connect Gateway is designed to connect on-premises networks to multiple VPCs via Direct Connect, but it does not provide transitive routing between VPCs themselves; it only facilitates connectivity between on-premises and VPCs. Option D is wrong because VPC Endpoints (Gateway or Interface endpoints) provide private connectivity to AWS services (e.g., S3, DynamoDB) from within a VPC, not inter-VPC routing or transitive connectivity between VPCs.

Practice this question →
231
Multi-Selecteasy

A company is deploying a web application in a VPC. They need to ensure that the web servers can be accessed from the internet and that traffic is encrypted. Which TWO services should they use?

Select 2 answers
A.AWS WAF
B.Application Load Balancer (ALB)
C.NAT Gateway
D.AWS Certificate Manager (ACM)
E.Amazon CloudFront
AnswersB, D

ALB can terminate SSL/TLS and route traffic to targets.

Why this answer

The Application Load Balancer (ALB) is correct because it can terminate TLS connections, offloading encryption from the web servers, and it distributes incoming internet traffic across multiple targets in a VPC. Combined with AWS Certificate Manager (ACM), the ALB can use a managed SSL/TLS certificate to encrypt traffic between clients and the load balancer, meeting the requirement for encrypted internet access.

Exam trap

The trap here is that candidates often select CloudFront (Option E) thinking it is required for encryption, but the ALB with ACM directly provides TLS termination and internet-facing access without needing a CDN, and the question specifically asks for two services that ensure encrypted internet access, not content delivery optimization.

Practice this question →
232
MCQmedium

A company is designing a network for a three-tier web application. The web tier must be able to scale out and in automatically based on CPU utilization. The database tier must be highly available and use Multi-AZ deployment. Which combination of AWS services should the architect use?

A.Network Load Balancer, Auto Scaling group, Amazon RDS Multi-AZ
B.Application Load Balancer, Auto Scaling group, Amazon DynamoDB
C.Application Load Balancer, Auto Scaling group, Amazon RDS Multi-AZ
D.Classic Load Balancer, Auto Scaling group, Amazon RDS Single-AZ
AnswerC

ALB handles HTTP/HTTPS traffic, Auto Scaling adjusts capacity, and RDS Multi-AZ provides HA.

Why this answer

An Application Load Balancer (ALB) operates at Layer 7, which is ideal for distributing HTTP/HTTPS traffic to a web tier that scales out and in automatically via an Auto Scaling group based on CPU utilization. Amazon RDS Multi-AZ provides synchronous standby replication across Availability Zones, ensuring high availability for the database tier by automatically failing over to the standby in case of an outage.

Exam trap

AWS often tests the misconception that a Network Load Balancer is suitable for all web applications, but the trap here is that the web tier requires Layer 7 features (like HTTP header inspection) for proper scaling and routing, which only the Application Load Balancer provides.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer (NLB) operates at Layer 4 and is not optimized for HTTP/HTTPS traffic inspection or path-based routing, which is typically required for a three-tier web application; it also lacks native integration with Auto Scaling group health checks for web tier scaling. Option B is wrong because Amazon DynamoDB is a NoSQL database, not a relational database, and does not support Multi-AZ deployment in the same way as RDS; it also does not meet the requirement for a highly available database tier using Multi-AZ deployment. Option D is wrong because Amazon RDS Single-AZ does not provide high availability, as it lacks automatic failover to a standby instance in a different Availability Zone, and the Classic Load Balancer is a legacy option that does not support advanced Layer 7 features like host-based or path-based routing.

Practice this question →
233
Multi-Selecteasy

A company is designing a high-availability architecture for an application that will be deployed across multiple Availability Zones. Which THREE components are recommended for this design? (Choose three.)

Select 3 answers
A.One EC2 instance in each AZ
B.Application Load Balancer across multiple AZs
C.NAT Gateway in each AZ
D.Auto Scaling group with instances in multiple AZs
E.Single NAT Gateway in one AZ
AnswersB, C, D

Distributes traffic across AZs.

Why this answer

An Application Load Balancer (ALB) distributes incoming traffic across multiple targets in different Availability Zones (AZs). By enabling cross-zone load balancing, the ALB can route requests to healthy instances in any AZ, ensuring that if one AZ fails, traffic is automatically redirected to instances in the remaining AZs. This is a foundational component for high availability because it eliminates a single point of failure at the traffic distribution layer.

Exam trap

AWS often tests the misconception that a single NAT Gateway is sufficient for high availability, but in a multi-AZ architecture, you must deploy a NAT Gateway in each AZ to maintain outbound connectivity during an AZ failure.

Practice this question →
234
MCQeasy

A company wants to connect its on-premises data center to AWS using AWS Direct Connect with a public VIF to access Amazon S3. The on-premises network team reports that they can ping the Direct Connect public VIF IP but cannot access S3. The VPC has a private subnet with an S3 VPC endpoint. What is the most likely reason for the failure?

A.Direct Connect does not support access to Amazon S3; you must use VPN.
B.The S3 endpoint is configured in the VPC, but the on-premises traffic is not using the endpoint.
C.The on-premises network is not routing traffic to S3 through the Direct Connect public VIF; instead, it is attempting to use the internet.
D.A security group is blocking traffic from the on-premises network to S3.
AnswerC

On-premises traffic to S3 must be routed through the Direct Connect public VIF. If the on-premises network does not have routes pointing to the public VIF, traffic may go over the internet, causing failure.

Why this answer

To access S3 via a Direct Connect public VIF, traffic must be routed through the public VIF, not through the internet. On-premises traffic destined for S3 will use the public VIF only if the on-premises routing directs it appropriately. If the on-premises network does not have specific routes pointing S3 traffic to the Direct Connect public VIF, it may attempt to use the internet, which can be blocked or not intended.

Option A is incorrect because Direct Connect does support access to S3 via public VIF. Option B is incorrect because the S3 VPC endpoint is for instances within the VPC, not for on-premises traffic. Option D is incorrect because security groups do not apply to traffic that traverses Direct Connect; they apply to VPC traffic.

Practice this question →
235
MCQeasy

A company is designing a hybrid network where an Amazon VPC is connected to an on-premises data center via AWS Direct Connect and a VPN backup. They have a VPC with CIDR 10.0.0.0/16 and on-premises CIDR 192.168.0.0/16. They want to ensure that all traffic between the VPC and on-premises uses the Direct Connect connection when it is available, and automatically fails over to the VPN if Direct Connect fails. What should they do?

A.Create a virtual private gateway with a Direct Connect private virtual interface. Additionally, create a separate VPN connection directly to the VPC. Set longer AS path for the Direct Connect routes.
B.Create a virtual private gateway and establish both a Direct Connect private virtual interface and a VPN connection. Use BGP with equal AS path lengths to enable ECMP.
C.Create a virtual private gateway and attach a Direct Connect private virtual interface. For failover, add a static route in the VPC route table pointing to the VPN connection.
D.Create a virtual private gateway attached to the VPC. Establish a Direct Connect private virtual interface and a VPN connection to the virtual private gateway. Configure BGP on both connections and use a shorter AS path for the Direct Connect routes.
AnswerD

The shorter AS path makes Direct Connect preferred, and BGP provides automatic failover.

Why this answer

It uses a virtual private gateway (VGW) for both the Direct Connect private virtual interface and the VPN connection, and configures BGP on both. By advertising a shorter AS path (e.g., prepending fewer AS numbers) for the Direct Connect routes, the VPC and on-premises routers prefer the Direct Connect path when available. If Direct Connect fails, the BGP session drops, and the VPN routes (with a longer AS path) become active, providing automatic failover.

Exam trap

AWS often tests the misconception that you can simply attach a Direct Connect private virtual interface to a VGW and then add a static route for failover, but this ignores the need for BGP-based dynamic failover and the risk of route conflicts or black-holing when both paths are active.

How to eliminate wrong answers

Option A is wrong because setting a longer AS path for Direct Connect routes would make them less preferred, causing traffic to use the VPN instead of Direct Connect when both are available. Option B is wrong because using equal AS path lengths with ECMP would load-balance traffic across both connections, not prioritize Direct Connect as the primary path. Option C is wrong because adding a static route in the VPC route table for failover does not provide automatic failover; the static route would be active simultaneously, potentially causing asymmetric routing or black-holing, and it lacks BGP-based dynamic failover detection.

Practice this question →
236
MCQeasy

A company is designing a multi-VPC architecture in the same region. The VPCs need to communicate with each other using private IP addresses. The company must minimize cost and operational overhead. Which solution should the company use?

A.Set up AWS Site-to-Site VPN connections between each VPC.
B.Use ClassicLink to connect the VPCs.
C.Create VPC peering connections between each pair of VPCs.
D.Create a Transit Gateway and attach all VPCs.
AnswerC

VPC peering is simple, low-cost, and uses private IPs.

Why this answer

VPC peering connections provide direct, private IP connectivity between VPCs using the AWS global network, with no bandwidth bottlenecks or single points of failure. It is the most cost-effective solution for a small number of VPCs (e.g., fewer than 10) as there are no hourly charges for the peering connection itself—only data transfer costs. This minimizes operational overhead compared to managing VPN tunnels or a Transit Gateway, as peering is a simple, one-to-one relationship that does not require additional appliances or complex routing policies.

Exam trap

The trap here is that candidates often choose Transit Gateway (Option D) because it is a modern, centralized solution, but they overlook the specific constraint of minimizing cost and operational overhead for a small number of VPCs, where VPC peering is simpler and cheaper.

How to eliminate wrong answers

Option A is wrong because AWS Site-to-Site VPN connections require a virtual private gateway on each VPC and incur hourly charges per VPN connection, plus data transfer costs, making it more expensive and operationally complex than VPC peering for intra-region VPC communication. Option B is wrong because ClassicLink is a legacy feature that only allows EC2 instances in the EC2-Classic platform to communicate with VPCs using private IPs; it does not support connecting multiple VPCs together and has been deprecated for most use cases. Option D is wrong because while a Transit Gateway simplifies routing for many VPCs, it incurs an hourly attachment fee per VPC and data transfer costs, which is unnecessary overhead for a small number of VPCs that can be directly peered at lower cost.

Practice this question →
237
MCQhard

A company is deploying a critical application that requires low latency between EC2 instances in the same AWS region but across multiple Availability Zones. The instances are part of an Auto Scaling group behind a Network Load Balancer. Which network design provides the lowest latency while maintaining high availability?

A.Use a cluster placement group across two Availability Zones.
B.Do not use a placement group; enable Enhanced Networking (ENA) on all instances.
C.Use a spread placement group across two Availability Zones.
D.Use a partition placement group across two Availability Zones.
AnswerB

Placement groups are limited to single AZ for low latency; Enhanced Networking provides low latency across AZs without placement group constraints.

Why this answer

Enhanced Networking (ENA) provides the highest possible packet-per-second performance and lowest latency by offloading network processing to dedicated hardware on the instance. Since the application requires low latency across multiple Availability Zones, a placement group is not suitable because cluster placement groups cannot span multiple AZs, and spread/partition placement groups do not improve latency — they only control instance placement for fault isolation. ENA alone, combined with a Network Load Balancer, delivers the lowest latency while maintaining high availability across AZs.

Exam trap

The trap here is that candidates assume a placement group is always beneficial for low latency, but they fail to recognize that cluster placement groups cannot span AZs and that spread/partition placement groups do not reduce network latency — they only control physical placement for fault tolerance.

How to eliminate wrong answers

Option A is wrong because a cluster placement group cannot span multiple Availability Zones — it is confined to a single AZ, which would violate the high-availability requirement across AZs. Option C is wrong because a spread placement group is designed to isolate instances across distinct hardware to reduce correlated failures, not to reduce network latency; it does not provide any latency benefit over standard placement. Option D is wrong because a partition placement group is used for large distributed workloads like HDFS or Cassandra to isolate failure domains, and it does not improve inter-instance latency.

Practice this question →
238
MCQhard

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The company has a single hosted virtual interface (VIF) with a private VIF to a VPC. The network team notices that traffic from on-premises to AWS is asymmetric—some packets go through the Direct Connect while others use a VPN backup. The team wants all traffic to use Direct Connect when available. What should they do?

A.Disable AS_PATH prepending on the Direct Connect BGP session.
B.Convert the private VIF to a public VIF.
C.Remove the VPN connection to force all traffic through Direct Connect.
D.Advertise more specific prefixes (e.g., /24) over Direct Connect and less specific (e.g., /16) over VPN.
AnswerD

Correct: More specific BGP routes are preferred, so Direct Connect will be used when available.

Why this answer

BGP route selection prefers more specific prefixes (longest prefix match) over less specific ones. By advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /16) over the VPN, the on-premises router will prefer the Direct Connect path for the more specific route, ensuring all traffic uses Direct Connect when available. This leverages BGP's prefix-length-based path selection without requiring removal of the VPN backup.

Exam trap

The trap here is that candidates often assume AS_PATH prepending or removing the VPN is the solution, but the key is understanding that BGP's longest prefix match overrides all other path selection attributes, making prefix specificity the most reliable way to enforce traffic flow.

How to eliminate wrong answers

Option A is wrong because disabling AS_PATH prepending on the Direct Connect BGP session would make the Direct Connect path appear shorter (lower AS_PATH length), but it does not address the root cause of asymmetric routing if the VPN is advertising a more specific prefix or if the on-premises router is using a different metric. Option B is wrong because converting a private VIF to a public VIF would change the connectivity type from private (VPC access) to public (AWS public services), which is unrelated to fixing asymmetric routing between on-premises and a VPC. Option C is wrong because removing the VPN connection eliminates the backup path entirely, which violates the requirement to have a backup available and does not solve the routing preference issue—it forces traffic through Direct Connect but removes redundancy.

Practice this question →
239
Multi-Selecteasy

A company has an AWS Transit Gateway with multiple VPC attachments. They need to inspect traffic between VPCs using a third-party firewall appliance. Which THREE steps are necessary?

Select 3 answers
A.Create a VPC peering connection between the VPCs to allow traffic flow
B.Deploy a Gateway Load Balancer (GWLB) in the firewall VPC and register the firewall instances as targets
C.Configure Transit Gateway route tables to route traffic between VPCs through the firewall VPC
D.Configure a NAT Gateway in each VPC to route traffic through the firewall
E.Attach a VPC containing the firewall appliance to the Transit Gateway
AnswersB, C, E

GWLB integrates with Transit Gateway and transparently routes traffic to the firewall instances.

Why this answer

A Gateway Load Balancer (GWLB) is designed to transparently insert third-party firewall appliances into network traffic paths. By deploying a GWLB in the firewall VPC and registering the firewall instances as targets, traffic can be inspected at Layer 3/4 without modifying the source or destination IP addresses, enabling seamless integration with Transit Gateway routing.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering can be used for transitive routing through a central inspection VPC, but peering is non-transitive and requires a full mesh, making Transit Gateway with GWLB the correct approach.

Practice this question →
240
MCQeasy

A company is deploying a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application must be accessible from the internet. Which component must be attached to the VPC to allow internet traffic to reach the ALB?

A.NAT gateway
B.Virtual private gateway
C.Internet gateway
D.Transit gateway
AnswerC

An internet gateway is required for internet traffic to reach resources in a VPC.

Why this answer

An Internet Gateway (IGW) is a horizontally scaled, redundant component that allows communication between a VPC and the internet. For an Application Load Balancer (ALB) to receive traffic from the internet, the ALB must be deployed in public subnets, and those subnets must have a route table entry pointing 0.0.0.0/0 to an IGW. Without the IGW, the ALB cannot accept inbound connections from the internet.

Exam trap

The trap here is that candidates often confuse the NAT gateway (which provides outbound-only internet access) with the Internet Gateway (which provides bidirectional internet access), leading them to select the NAT gateway for inbound traffic scenarios.

How to eliminate wrong answers

Option A is wrong because a NAT gateway is used to enable outbound internet access for instances in private subnets, not to allow inbound internet traffic to reach an ALB. Option B is wrong because a Virtual Private Gateway is used to connect a VPC to an on-premises network via VPN or Direct Connect, not for internet-facing traffic. Option D is wrong because a Transit Gateway is a hub for interconnecting VPCs and on-premises networks, not a device that provides internet connectivity to a VPC.

Practice this question →
241
Multi-Selectmedium

A company is designing a network architecture for a critical application that requires high availability across multiple AWS regions. The application uses an Application Load Balancer (ALB) in each region. Which TWO services can provide global routing and failover between the two ALBs?

Select 2 answers
A.Amazon Route 53 with failover routing and health checks
B.AWS WAF
C.Network Load Balancer (NLB)
D.Amazon CloudFront
E.AWS Global Accelerator
AnswersA, E

Route 53 can route traffic to the primary region and failover to the secondary based on health checks.

Why this answer

Amazon Route 53 with failover routing policy and health checks can route traffic to the primary ALB and automatically fail over to the secondary ALB in another region when the primary health check fails. This provides global DNS-based routing and failover across regions, meeting the high-availability requirement.

Exam trap

The trap here is that candidates may think CloudFront or an NLB can provide cross-region failover, but CloudFront lacks health-check-based failover routing and an NLB is regional, while only Route 53 failover routing and Global Accelerator offer global traffic steering with health check integration.

Practice this question →
242
MCQhard

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a new CIDR block 10.1.0.0/16 to accommodate more subnets. The VPC already has multiple subnets and route tables. What is the impact of adding this secondary CIDR?

A.The secondary CIDR will be automatically advertised to all route tables.
B.Existing subnets and route tables remain unchanged; new subnets can be created in the new CIDR.
C.The VPC will experience a brief outage while the new CIDR is being associated.
D.Existing subnets will automatically be extended to include IPs from the new CIDR.
AnswerB

Secondary CIDRs do not affect existing resources.

Why this answer

Adding a secondary CIDR block to an existing VPC is a non-disruptive operation. The existing subnets and route tables remain completely unchanged because the secondary CIDR is an additional IP address space, not a modification of the existing one. New subnets can be created within the new CIDR block, and you must explicitly associate them with route tables as needed.

Exam trap

AWS often tests the misconception that adding a secondary CIDR automatically propagates to route tables or extends existing subnets, when in fact it requires manual route table updates and new subnet creation.

How to eliminate wrong answers

Option A is wrong because secondary CIDRs are not automatically advertised to route tables; you must explicitly add routes for the new CIDR to each route table where it is needed. Option C is wrong because adding a secondary CIDR does not cause any outage or disruption to the VPC or its existing resources. Option D is wrong because existing subnets are not automatically extended; they are tied to their original CIDR block, and new subnets must be created in the new CIDR range.

Practice this question →
243
MCQeasy

A company needs to resolve DNS names for their EC2 instances using custom domain names like "app.example.com". Which AWS service should they use?

A.AWS Cloud Map
B.AWS Directory Service
C.Amazon Route 53
D.Amazon Cognito
AnswerC

Managed DNS service.

Why this answer

Amazon Route 53 is a scalable DNS web service that can resolve custom domain names like 'app.example.com' to EC2 instance IP addresses. It supports private hosted zones for VPCs, enabling DNS resolution for internal resources without exposing them to the internet, and integrates with EC2 via alias records or health checks.

Exam trap

The trap here is that candidates confuse AWS Cloud Map's service discovery capabilities with DNS resolution, but Cloud Map is designed for dynamic service endpoints (e.g., ECS tasks) and does not natively resolve arbitrary custom domain names like 'app.example.com' without Route 53.

How to eliminate wrong answers

Option A is wrong because AWS Cloud Map is a service for service discovery that manages dynamic resource mappings (e.g., for microservices), not a DNS resolver for custom domain names; it relies on Route 53 for DNS resolution. Option B is wrong because AWS Directory Service provides managed Microsoft Active Directory or LDAP-based directory services for authentication and authorization, not DNS resolution for custom domain names. Option D is wrong because Amazon Cognito is an identity and access management service for user sign-up, sign-in, and federation, not a DNS service.

Practice this question →
244
MCQeasy

A company wants to use Amazon Route 53 to resolve DNS queries for a domain they own. They want to ensure that DNS queries are answered quickly and that there is no single point of failure. Which configuration should they use?

A.Deploy Route 53 in multiple AWS Regions.
B.Create a hosted zone and let Route 53 automatically handle the DNS resolution.
C.Create multiple hosted zones in separate AWS accounts.
D.Create a single hosted zone and assign it to one Route 53 name server.
AnswerB

Route 53 is inherently highly available.

Why this answer

When you create a hosted zone in Route 53, AWS automatically provisions four authoritative name servers (NS records) distributed across multiple globally redundant data centers. This design inherently provides high availability and low-latency DNS resolution without any additional configuration, as Route 53 uses Anycast routing to direct queries to the nearest healthy name server.

Exam trap

The trap here is that candidates may think Route 53 is a regional service like EC2 or RDS, leading them to choose Option A, or they may mistakenly believe that creating multiple hosted zones or accounts increases redundancy, when in fact a single hosted zone with its four automatically assigned name servers already provides full fault tolerance and low latency.

How to eliminate wrong answers

Option A is wrong because Route 53 is a global service, not a regional one; deploying it in multiple AWS Regions is not possible or necessary, as the service already operates from multiple edge locations worldwide via Anycast. Option C is wrong because creating multiple hosted zones in separate AWS accounts does not improve DNS resolution speed or fault tolerance; it only adds administrative complexity and potential synchronization issues, as each hosted zone would be authoritative for the same domain, causing conflicts. Option D is wrong because a single hosted zone is automatically assigned to four Route 53 name servers, not one; assigning it to a single name server would create a single point of failure and violate DNS best practices (RFC 1034/1035 require multiple authoritative servers).

Practice this question →
245
MCQmedium

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: subnet-A (10.0.1.0/24) and subnet-B (10.0.2.0/24). An EC2 instance in subnet-A needs to communicate with an RDS database in subnet-B. Both subnets are in the same Availability Zone. What is the most efficient way to enable this communication?

A.Create a Transit Gateway and attach both subnets to it.
B.Place a NAT Gateway in subnet-A and configure route tables accordingly.
C.No additional configuration is required. The instance and database can communicate within the same VPC.
D.Create a VPC Peering connection between the two subnets.
AnswerC

VPC internal routing allows communication between subnets in the same VPC.

Why this answer

Both the EC2 instance and the RDS database reside within the same VPC (10.0.0.0/16), and subnets within a VPC can communicate with each other by default using the VPC's local route. No additional configuration is needed, as the VPC's main route table or subnet route tables already include a local route for the VPC CIDR, enabling direct communication within the same Availability Zone.

Exam trap

The trap here is that candidates may overthink the scenario and assume that different subnets require additional networking components like a Transit Gateway or VPC Peering, forgetting that subnets within the same VPC inherently have local connectivity via the VPC's route table.

How to eliminate wrong answers

Option A is wrong because a Transit Gateway is used to connect multiple VPCs or on-premises networks, not to enable communication between subnets within the same VPC, which already have native connectivity. Option B is wrong because a NAT Gateway is used to provide outbound internet access to instances in private subnets, not to enable communication between two subnets within the same VPC; it would add unnecessary complexity and cost. Option D is wrong because VPC Peering is used to connect two different VPCs, not subnets within the same VPC; subnets in the same VPC already communicate via the local route.

Practice this question →
246
MCQmedium

A company wants to connect multiple VPCs across different AWS Regions using AWS Transit Gateway. Which feature allows the VPCs to communicate with each other using private IP addresses without creating peering connections?

A.AWS Direct Connect gateway
B.AWS PrivateLink
C.Transit Gateway inter-Region peering
D.VPC Peering
AnswerC

Transit Gateway supports inter-Region peering for transitive routing between VPCs across Regions.

Why this answer

Transit Gateway inter-Region peering allows VPCs in different AWS Regions to communicate using private IP addresses through a central Transit Gateway, without requiring individual VPC peering connections. This feature uses the AWS global network to route traffic between peered Transit Gateways, enabling cross-region connectivity with a hub-and-spoke architecture.

Exam trap

The trap here is that candidates may confuse Transit Gateway inter-Region peering with VPC Peering, assuming VPC Peering is the only way to connect VPCs across regions, but Transit Gateway provides a scalable, centralized alternative without the need for full-mesh peering.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect gateway is used to connect on-premises networks to AWS via Direct Connect, not to connect VPCs across regions. Option B is wrong because AWS PrivateLink enables private connectivity to services via Network Load Balancers and interface VPC endpoints, but it does not provide routing between multiple VPCs. Option D is wrong because VPC Peering requires creating individual peering connections between each pair of VPCs, which does not scale and does not use a central Transit Gateway.

Practice this question →
247
MCQmedium

A company has a VPC with public and private subnets. The private subnets need outbound internet access for software updates. The company wants to ensure that traffic from private subnets uses a single, highly available IP address for outbound traffic. Which solution meets these requirements?

A.Deploy a single EC2 instance configured as a NAT instance in a public subnet.
B.Configure a fleet of proxy servers in an Auto Scaling group with a Network Load Balancer.
C.Create a NAT gateway in a public subnet and route traffic from private subnets to it.
D.Use a VPC endpoint for Amazon S3 to access software updates.
AnswerC

NAT gateway is managed, highly available, and provides a single Elastic IP.

Why this answer

A NAT gateway provides managed, highly available outbound internet access for private subnets using a single elastic IP address. It is deployed in a public subnet and automatically handles failover within an Availability Zone, meeting the requirement for a single, highly available IP for outbound traffic.

Exam trap

The ANS-C01 exam often tests the misconception that a single NAT instance or a proxy fleet with an NLB can provide both high availability and a single outbound IP, but the trap here is that a NAT gateway is the only managed service that inherently combines high availability with a single elastic IP for outbound traffic without additional configuration.

How to eliminate wrong answers

Option A is wrong because a single EC2 instance configured as a NAT instance is a single point of failure and does not provide high availability; it also requires manual management and lacks automatic failover. Option B is wrong because a fleet of proxy servers with a Network Load Balancer introduces unnecessary complexity and does not guarantee a single outbound IP address (the NLB preserves client IPs by default, and proxy servers may use multiple IPs unless explicitly configured). Option D is wrong because a VPC endpoint for Amazon S3 only provides private connectivity to S3, not general outbound internet access for software updates from other sources.

Practice this question →
248
Multi-Selecteasy

Which TWO of the following are required to establish an AWS Site-to-Site VPN connection? (Select TWO.)

Select 2 answers
A.Direct Connect gateway
B.Virtual private gateway
C.Customer gateway
D.Transit gateway
E.VPN connection
AnswersB, C

AWS-side endpoint for the VPN.

Why this answer

A virtual private gateway (VGW) is required as the AWS-side endpoint for the VPN tunnel; it anchors the encrypted IPsec session and routes traffic from the VPC to the on-premises network. The customer gateway (CGW) represents the on-premises VPN device in AWS, providing the public IP and BGP ASN (for dynamic routing) or static route configuration needed to establish the tunnel. Both are mandatory components of an AWS Site-to-Site VPN connection.

Exam trap

AWS often tests the misconception that a transit gateway is required for Site-to-Site VPN, but it is only needed when connecting multiple VPCs or using advanced routing features; a simple VPN to a single VPC only needs a VGW and CGW.

Practice this question →
249
MCQeasy

A company has an existing VPC with a public subnet and a private subnet. The company launches an EC2 instance in the private subnet. The instance needs to access an S3 bucket to download software updates. The company does not want the instance to have a public IP address. The company creates a VPC endpoint for S3 (Gateway type) in the VPC, and associates it with the private subnet route table by adding a route for the S3 prefix list. However, the instance still cannot access the S3 bucket. The security group for the instance allows all outbound traffic. The network ACL for the private subnet allows all inbound and outbound traffic. What is the MOST likely reason for the connectivity failure?

A.The network ACL is blocking the traffic
B.The security group does not allow outbound HTTPS traffic
C.The VPC endpoint policy does not grant access to the S3 bucket
D.The instance does not have a route to the internet
AnswerC

Correct; the endpoint policy may be restrictive.

Why this answer

The most likely reason is that the VPC endpoint policy does not grant access to the S3 bucket. Even though the Gateway VPC Endpoint is created and associated with the private subnet route table, the endpoint's policy controls which S3 buckets and actions are allowed. If the policy is too restrictive (e.g., default deny or does not explicitly allow access to the specific bucket), traffic will be dropped at the endpoint, preventing the instance from downloading updates.

The security group and network ACL are already permissive, and internet access is not required because the Gateway endpoint uses AWS's private network.

Exam trap

AWS often tests the misconception that a Gateway VPC Endpoint automatically grants access to all S3 buckets once the route is added, ignoring that the endpoint policy must explicitly allow the desired S3 actions and resources.

How to eliminate wrong answers

Option A is wrong because the network ACL for the private subnet allows all inbound and outbound traffic, so it is not blocking anything. Option B is wrong because the security group allows all outbound traffic (including HTTPS), so outbound HTTPS is permitted. Option D is wrong because the instance does not need a route to the internet; a Gateway VPC Endpoint for S3 provides connectivity to S3 over the AWS private network without requiring internet access.

Practice this question →
250
MCQmedium

A company is designing a multi-region architecture with VPCs in us-east-1 and eu-west-1. The company needs low-latency connectivity between the VPCs and wants to avoid traffic over the public internet. The VPCs have overlapping CIDR blocks (10.0.0.0/16). Which solution should the network engineer recommend?

A.Set up an AWS Transit Gateway in each region and connect them via Transit Gateway peering.
B.Use a Direct Connect connection between the regions.
C.Use VPC peering between the two VPCs.
D.Place all resources in a single VPC with multiple Availability Zones.
AnswerA

This is correct. Although not the most optimal solution (Transit Gateway peering would be ideal), a VPN attachment between Transit Gateways can provide private connectivity between regions, even with overlapping CIDRs, by using separate route tables per VPC attachment.

Why this answer

AWS Transit Gateway supports inter-region peering, which uses the AWS global backbone to provide low-latency, private connectivity between VPCs in different regions without traversing the public internet. This solution also handles overlapping CIDRs by using separate route tables per VPC attachment, ensuring isolation. Option B (Direct Connect) is used for on-premises connectivity, not inter-region.

Option C (VPC peering) does not support overlapping CIDRs. Option D (single VPC) does not meet the multi-region requirement.

Exam trap

Candidates may mistakenly think that VPN attachments are required for inter-region connectivity, but Transit Gateway peering is the native, low-latency solution that avoids the public internet. They may also confuse Transit Gateway peering with VPC peering, which cannot handle overlapping CIDRs.

How to eliminate wrong answers

Option B is wrong because Direct Connect is a dedicated connection from on-premises to AWS, not between AWS regions; it does not provide inter-region VPC connectivity. Option C is wrong because VPC peering requires non-overlapping CIDR blocks; with overlapping 10.0.0.0/16 CIDRs, peering is impossible as it would cause routing conflicts and AWS explicitly prohibits peering with overlapping ranges. Option D is wrong because the requirement is for a multi-region architecture, and placing all resources in a single VPC with multiple Availability Zones only provides high availability within one region, not cross-region connectivity.

Practice this question →
251
MCQhard

A company is designing a multi-region active-active architecture using Application Load Balancers (ALBs) and AWS Global Accelerator. The application must have the lowest possible latency for global users. Which design meets these requirements?

A.Use AWS Global Accelerator with endpoints in both regions and configure traffic dials to distribute traffic.
B.Use Amazon CloudFront with multiple origins pointing to each ALB.
C.Use Amazon Route 53 with latency routing policy to route users to the closest ALB.
D.Use AWS Global Accelerator with a single endpoint in one region and failover to the other region.
AnswerA

Global Accelerator provides anycast IPs and can distribute traffic across multiple regions with traffic dials.

Why this answer

AWS Global Accelerator uses the Anycast static IP addresses to route traffic over the AWS global network to the optimal endpoint based on health, latency, and traffic dials. By configuring endpoints in both regions with traffic dials, you can distribute traffic actively across both regions, ensuring the lowest possible latency for global users by directing them to the nearest healthy endpoint.

Exam trap

The trap here is that candidates often confuse DNS-based routing (Route 53 latency routing) with anycast-based routing (Global Accelerator), not realizing that DNS caching and propagation delays prevent true real-time, lowest-latency routing for active-active architectures.

How to eliminate wrong answers

Option B is wrong because Amazon CloudFront is a content delivery network (CDN) optimized for caching static and dynamic content at edge locations, not for accelerating TCP/UDP traffic to ALBs with active-active multi-region load balancing; it adds an extra hop and does not provide the same low-latency, anycast-based routing for non-HTTP(S) workloads. Option C is wrong because Amazon Route 53 latency routing policy operates at the DNS level, which introduces DNS caching and propagation delays, and cannot route traffic based on real-time network conditions or provide fast failover for active-active architectures; it also does not offer static IP addresses. Option D is wrong because using a single endpoint in one region with failover to the other region creates an active-passive architecture, not active-active, which means users are always routed to the primary region unless it fails, increasing latency for users far from that region and failing to meet the requirement for lowest possible latency for global users.

Practice this question →
252
MCQmedium

A company is deploying a new application in a VPC that uses a single Availability Zone. The application consists of an Application Load Balancer (ALB) in a public subnet and EC2 instances in a private subnet. The EC2 instances need to send logs to an Amazon S3 bucket. The company has created a VPC gateway endpoint for S3 and associated it with the route table for the private subnet. The EC2 instances have an instance profile that grants access to the S3 bucket. However, the log delivery fails. The network team has verified that the route table for the private subnet includes a route to the S3 prefix list via the gateway endpoint. What is the MOST likely cause of the failure?

A.The route table does not have a route to the S3 prefix list.
B.The VPC endpoint is not configured with private DNS.
C.The security group on the EC2 instances does not allow outbound traffic to the S3 prefix list.
D.The VPC endpoint policy does not allow the PutObject action on the S3 bucket.
AnswerD

Correct: Endpoint policy must allow the action.

Why this answer

The most likely cause is that the VPC endpoint policy does not allow the PutObject action on the S3 bucket. Even though the route table has a route to the S3 prefix list via the gateway endpoint and the EC2 instance profile grants access, the endpoint policy acts as an additional layer of authorization. If the endpoint policy does not explicitly allow the s3:PutObject action for the target bucket, requests will be denied, causing the log delivery to fail.

Exam trap

The trap here is that candidates often assume that if routing is correct and the instance has IAM permissions, the request will succeed, overlooking that the VPC endpoint policy is a separate authorization layer that must explicitly allow the action.

How to eliminate wrong answers

Option A is wrong because the network team has verified that the route table includes a route to the S3 prefix list via the gateway endpoint, so routing is correctly configured. Option B is wrong because private DNS is only relevant for interface endpoints (which use private IP addresses and DNS resolution), not for gateway endpoints, which do not support private DNS. Option C is wrong because security groups do not filter traffic to prefix lists for gateway endpoints; gateway endpoints use route tables for routing and security groups apply to traffic at the instance level, but outbound traffic to the S3 prefix list is not blocked by a security group since the traffic is routed through the endpoint and not through a NAT or internet gateway.

Practice this question →
253
MCQmedium

A company is designing a multi-region application with Amazon RDS for MySQL as the primary database. The application requires read-after-write consistency across regions. Which design should the company choose to meet this requirement?

A.Use Amazon RDS with cross-Region replication enabled using MySQL binary log
B.Use Amazon RDS Multi-AZ deployments in each region with read replicas
C.Use Amazon Aurora Global Database with cluster endpoints in each region
D.Use Amazon RDS with synchronous replication across regions
AnswerC

Aurora Global Database uses dedicated replication infrastructure with typical latency under 1 second and supports read-after-write consistency via global transaction IDs.

Why this answer

Amazon Aurora Global Database is the correct choice because it provides dedicated cluster endpoints in each region that automatically route write traffic to the primary region and read traffic to local replicas, ensuring read-after-write consistency through its storage-layer replication with typical latency under 1 second. Unlike standard RDS cross-Region replication, Aurora Global Database uses a physical storage-based replication mechanism that guarantees global consistency without relying on MySQL binary logs, which can introduce replication lag and potential inconsistency.

Exam trap

AWS often tests the misconception that standard RDS cross-Region replication (Option A) can provide read-after-write consistency, but the trap is that MySQL binary log replication is inherently asynchronous and cannot guarantee global consistency, whereas Aurora Global Database's storage-level replication is designed specifically for this purpose.

How to eliminate wrong answers

Option A is wrong because cross-Region replication using MySQL binary log is asynchronous and can introduce significant replication lag, making it impossible to guarantee read-after-write consistency across regions. Option B is wrong because Multi-AZ deployments provide high availability within a single region only and do not support cross-Region read replicas for global consistency; read replicas in other regions would still be asynchronous. Option D is wrong because Amazon RDS does not support synchronous replication across regions; synchronous replication would require a custom solution and would introduce unacceptable latency over inter-region distances.

Practice this question →
254
Multi-Selecthard

A company is designing a network for a critical application that requires an SLA of 99.99% availability. The application runs on EC2 instances in an Auto Scaling group across three Availability Zones. The company needs to ensure that the network design meets the SLA. Which THREE components should the company include? (Choose THREE.)

Select 3 answers
A.A single AWS Direct Connect connection for all inbound traffic.
B.A NAT gateway in each Availability Zone for outbound internet access.
C.A single AWS Site-to-Site VPN connection for administrative access.
D.VPC endpoints for AWS services used by the application.
E.An Application Load Balancer (ALB) configured to route traffic to instances in all three Availability Zones.
AnswersB, D, E

NAT gateways per AZ eliminate single point of failure.

Why this answer

A NAT gateway in each Availability Zone ensures that outbound internet traffic remains within the same AZ, preventing cross-AZ data transfer costs and avoiding a single point of failure. This design supports the 99.99% SLA by maintaining high availability for outbound connectivity, as each AZ can independently handle its own traffic without relying on a shared resource.

Exam trap

The ANS-C01 exam often tests the misconception that a single Direct Connect or VPN connection is sufficient for high availability, but the trap here is that 99.99% SLA requires redundancy at every layer, including network connectivity, so a single connection is a single point of failure regardless of its reliability.

Practice this question →
255
Multi-Selecthard

A company has a multi-account AWS environment using AWS Organizations. The network team wants to centralize VPC traffic inspection using a Transit Gateway and a firewall appliance in a central account. Which THREE steps are required to implement this design? (Choose THREE.)

Select 3 answers
A.Create a VPC peering connection between each spoke VPC and the central VPC.
B.Create a Transit Gateway in the central account and attach the central VPC.
C.Accept the Transit Gateway share in each spoke account and attach their VPCs.
D.Deploy a firewall appliance in each spoke VPC.
E.Use AWS Resource Access Manager to share the Transit Gateway with spoke accounts.
AnswersB, C, E

Transit Gateway is the hub.

Why this answer

A Transit Gateway (TGW) in the central account acts as the hub for VPC traffic inspection. Attaching the central VPC (which contains the firewall appliance) to the TGW allows all inter-VPC traffic to be routed through the central inspection VPC, enabling centralized traffic inspection without requiring VPC peering or per-spoke firewalls.

Exam trap

AWS often tests the misconception that VPC peering can be used for transitive routing in a hub-and-spoke model, but the trap here is that VPC peering does not support transitive routing, so a Transit Gateway is required for centralized inspection across multiple VPCs.

Practice this question →
256
MCQmedium

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. It needs to connect to an on-premises data center over AWS Direct Connect. The on-premises network uses the 10.0.0.0/8 address space. The company cannot change the on-premises addressing. Which solution will allow connectivity without overlapping IP addresses?

A.Use VPC peering between the existing VPC and a new VPC with a non-overlapping CIDR, then route traffic through the new VPC.
B.Create a new VPC with a non-overlapping CIDR such as 172.16.0.0/16 and migrate resources.
C.Assign IPv6 CIDR to the existing VPC, use IPv6 for all resources, and connect over Direct Connect using IPv6.
D.Use AWS Transit Gateway with a Network Address Translation (NAT) attachment to translate the VPC CIDR.
AnswerC

IPv6 addresses do not overlap with the on-premises IPv4 space, providing unique addressing.

Why this answer

Assigning an IPv6 CIDR to the existing VPC and using IPv6 for all resources avoids the IPv4 address overlap with the on-premises 10.0.0.0/8 network. AWS Direct Connect supports both IPv4 and IPv6 traffic, so you can establish a BGP session over IPv6 and route IPv6 traffic between the VPC and on-premises, completely bypassing the conflicting IPv4 address space.

Exam trap

The trap here is that candidates assume Direct Connect only works with IPv4 or that overlapping IPv4 addresses can be resolved with NAT or Transit Gateway, but the exam tests the understanding that IPv6 is a clean way to avoid IPv4 overlap without changing the existing VPC CIDR.

How to eliminate wrong answers

Option A is wrong because VPC peering does not resolve IP address overlap; the existing VPC still uses 10.0.0.0/16, which overlaps with the on-premises 10.0.0.0/8, and routing through a new VPC does not change the fact that overlapping addresses cannot be communicated with directly. Option B is wrong because migrating resources to a new VPC with a non-overlapping CIDR (e.g., 172.16.0.0/16) is a valid long-term solution but does not allow connectivity without changing the existing VPC's addressing; the question asks for a solution that allows connectivity without overlapping IP addresses, and migration is a disruptive change, not a direct connectivity solution. Option D is wrong because AWS Transit Gateway does not have a 'NAT attachment'; NAT is typically implemented at the instance or gateway level (e.g., NAT gateway or instance), and Transit Gateway itself cannot perform network address translation between the VPC and on-premises networks.

Practice this question →
257
Multi-Selecthard

A company is designing a network architecture for a multi-tier web application. The application includes a public-facing Application Load Balancer (ALB) in a public subnet, web servers in private subnets, and an Amazon RDS database in a private subnet. The company requires that the database is not directly accessible from the application servers except through specific ports, and that traffic between the web servers and the database is encrypted. Which TWO actions should the company take to meet these requirements? (Choose two.)

Select 2 answers
A.Place the RDS database in a public subnet with a security group that allows only the web servers' IP addresses
B.Establish a VPC peering connection between the web servers' VPC and the RDS VPC
C.Enable SSL/TLS encryption for connections between the web servers and the RDS database
D.Configure a security group on the RDS instance that allows inbound traffic from the web servers' security group on the database port
E.Use a network ACL to restrict inbound traffic to the RDS subnet to only the web server's IP range
AnswersC, D

SSL/TLS encrypts data in transit, meeting the encryption requirement.

Why this answer

Enabling SSL/TLS encryption for connections between the web servers and the RDS database ensures that data in transit is encrypted, meeting the requirement for encrypted traffic. Option D is correct because configuring a security group on the RDS instance that allows inbound traffic from the web servers' security group on the database port provides a stateful, instance-level firewall rule that restricts direct access to only the web servers, without exposing the database to the public subnet or relying on IP-based rules.

Exam trap

AWS often tests the distinction between security groups (stateful, instance-level) and network ACLs (stateless, subnet-level), and candidates mistakenly choose network ACLs for fine-grained access control when security groups are the correct choice for allowing traffic based on source security group IDs.

Practice this question →
258
Multi-Selecteasy

A company is designing a VPC for a web application that requires high availability. The application will be deployed across multiple Availability Zones. Which THREE components are essential for a highly available network design? (Choose THREE.)

Select 3 answers
A.Subnets in at least two Availability Zones
B.A single VPN connection to on-premises
C.A NAT gateway in each Availability Zone
D.VPC peering with a backup VPC
E.An internet gateway attached to the VPC
AnswersA, C, E

Provides AZ redundancy.

Why this answer

Deploying subnets in at least two Availability Zones (AZs) ensures that if one AZ fails, the application can continue serving traffic from the other AZ. This is the foundational principle of high availability in AWS, as it provides fault isolation at the data center level. Without multi-AZ subnets, a single AZ failure would cause a complete outage.

Exam trap

The ANS-C01 exam often tests the misconception that a single VPN connection or VPC peering provides high availability, but in reality, these are single points of failure unless explicitly designed with redundancy (e.g., multiple VPN tunnels or multi-region peering).

Practice this question →
259
MCQmedium

A company is designing a hybrid network architecture that connects multiple VPCs in different AWS regions to an on-premises data center. The company wants to minimize the number of VPN tunnels and reduce management overhead. Which AWS service should be used to simplify this design?

A.AWS Transit Gateway with VPN attachments
B.AWS Direct Connect with multiple virtual interfaces
C.AWS VPN CloudHub
D.VPC peering between each VPC and the on-premises network
AnswerA

Transit Gateway provides a central hub that can connect multiple VPCs and on-premises networks via VPN, reducing the number of connections and simplifying management.

Why this answer

AWS Transit Gateway with VPN attachments is correct because it acts as a central hub that connects multiple VPCs across different AWS regions and an on-premises data center through a single VPN connection. This minimizes the number of VPN tunnels by eliminating the need for individual VPN connections between each VPC and the on-premises network, and reduces management overhead through a single point of configuration and routing.

Exam trap

The trap here is that candidates often confuse VPC peering as a viable option for on-premises connectivity, not realizing that VPC peering only works between VPCs and cannot extend to an on-premises network, leading them to overlook the centralized hub-and-spoke model of Transit Gateway.

How to eliminate wrong answers

Option B is wrong because AWS Direct Connect with multiple virtual interfaces does not inherently reduce the number of VPN tunnels; it still requires separate VPN connections or complex routing for multi-region VPC connectivity, and does not provide a centralized hub for inter-VPC and on-premises traffic. Option C is wrong because AWS VPN CloudHub is designed for connecting multiple on-premises sites to AWS via VPN, but it does not natively support inter-VPC connectivity across different regions without additional configuration and still requires multiple VPN tunnels for each VPC. Option D is wrong because VPC peering between each VPC and the on-premises network is not supported; VPC peering only connects VPCs within AWS and cannot directly connect to an on-premises data center, requiring additional VPN or Direct Connect attachments for each VPC, which increases management overhead.

Practice this question →
260
MCQhard

A company has a VPC with multiple subnets and an AWS Transit Gateway. They have a requirement to inspect traffic between subnets using a third-party firewall appliance that is deployed in a centralized inspection VPC. The firewall appliance must process all traffic between the VPC subnets, including traffic between subnets in the same Availability Zone. Which routing configuration achieves this?

A.Create a VPC route table that routes all traffic (0.0.0.0/0) to the Transit Gateway.
B.Create a VPC route table that routes the VPC CIDR to the Transit Gateway and associate it with each subnet.
C.Use the main route table and add a route for the VPC CIDR to the Transit Gateway.
D.None of the options are correct.
AnswerD

Same as B and C but associates custom route tables with each subnet. The local route still overrides, so intra-VPC traffic remains local.

Why this answer

None of the provided routing configurations can achieve this requirement because the local route for the VPC CIDR in any VPC route table cannot be overridden. Therefore, intra-VPC traffic will always use the local route and will not be sent to the Transit Gateway. To inspect traffic between subnets within the same VPC, alternative architectures such as a Gateway Load Balancer or a Transit Gateway with VPC peering between different VPCs must be used.

Exam trap

Candidates often assume that adding a route for the VPC CIDR to a Transit Gateway will override the implicit local route, but this is not possible. Intra-VPC traffic remains local.

How to eliminate wrong answers

Option A is wrong because routing 0.0.0.0/0 to the Transit Gateway only directs internet-bound traffic, not traffic within the VPC CIDR, leaving inter-subnet traffic to use the default local route. Option C is wrong because using the main route table with a VPC CIDR route to the Transit Gateway would affect only subnets that are not explicitly associated with a custom route table, but subnets with explicit associations would ignore the main table, and the local route still takes precedence for intra-VPC traffic unless overridden. Option D is wrong because while it correctly associates custom route tables with subnets, the route for the VPC CIDR to the Transit Gateway must be added to each subnet's route table; simply associating a custom route table without that specific route does not redirect inter-subnet traffic.

Practice this question →
261
Multi-Selectmedium

A company is designing a hybrid network using AWS Direct Connect. They need to ensure high availability and failover. Which THREE components should be deployed to meet these requirements?

Select 3 answers
A.A single AWS Direct Connect connection.
B.Two Customer Gateways (CGWs).
C.Two Virtual Private Gateways (VGWs).
D.Two AWS Direct Connect connections.
E.An AWS Site-to-Site VPN connection as backup.
AnswersB, C, D

Two CGWs provide on-premises redundancy.

Why this answer

To achieve high availability and failover with AWS Direct Connect, you need at least two Direct Connect connections (option D) to provide physical diversity and eliminate single points of failure. Additionally, you must deploy two Virtual Private Gateways (VGWs) (option C) to attach to separate Direct Connect Virtual Interfaces (VIFs) and enable active/active or active/passive routing. Finally, two Customer Gateways (CGWs) (option B) are required to terminate the BGP sessions from each Direct Connect connection, ensuring that if one CGW or connection fails, the other can take over traffic forwarding.

Exam trap

The trap here is that candidates often think a single Direct Connect connection with a VPN backup (option E) is sufficient for high availability, but the exam expects you to recognize that true high availability requires redundant physical connections and redundant BGP termination points (two VGWs and two CGWs) to avoid any single point of failure in the network path.

Practice this question →
262
Drag & Dropmedium

Arrange the steps to configure VPC Flow Logs for a VPC and publish logs to CloudWatch Logs:

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First create the log group, then the IAM role, then the flow log, then verify, then analyze.

Practice this question →
263
Multi-Selecteasy

A company is deploying a VPC with public and private subnets. They need to provide internet access to instances in the private subnets for software updates. Which THREE components are required to achieve this?

Select 3 answers
A.Route table in the private subnet with a default route pointing to the NAT Gateway
B.AWS Site-to-Site VPN connection
C.NAT Gateway in a public subnet
D.Internet Gateway attached to the VPC
E.AWS Direct Connect connection
AnswersA, C, D

The route table must direct traffic to the NAT Gateway for internet access.

Why this answer

A route table in the private subnet with a default route (0.0.0.0/0) pointing to a NAT Gateway ensures that outbound traffic from private instances destined for the internet is forwarded to the NAT Gateway. This allows instances in private subnets to initiate outbound connections for software updates while preventing any unsolicited inbound traffic from the internet.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT Gateway alone provides internet access without an Internet Gateway, but the Internet Gateway is mandatory for the NAT Gateway to reach the internet; candidates may also incorrectly think a VPN or Direct Connect can substitute for internet access.

Practice this question →
264
Multi-Selectmedium

A company is designing a network architecture for a critical application that requires high availability and fault tolerance. The application will be deployed on EC2 instances in an Auto Scaling group across three Availability Zones. The instances must be able to communicate with each other across AZs. Which TWO design decisions improve the fault tolerance of the application? (Choose TWO.)

Select 2 answers
A.Use a single NAT Gateway in one Availability Zone for internet access
B.Use VPC endpoints for Amazon S3 to reduce internet dependency
C.Configure the Auto Scaling group to launch instances in multiple Availability Zones
D.Use a single Network Load Balancer in one Availability Zone
E.Deploy EC2 instances evenly across three Availability Zones
AnswersC, E

Auto Scaling across AZs automatically replaces failed instances and maintains capacity.

Why this answer

Launching instances in multiple Availability Zones (AZs) ensures that if one AZ fails, the Auto Scaling group can still maintain capacity from the remaining AZs, providing fault tolerance. This design leverages the isolation boundaries of AZs within a region, which are physically separate data centers with independent power and networking.

Exam trap

The ANS-C01 exam often tests the misconception that a single NAT Gateway or a single NLB is sufficient for high availability, but the trap here is that these components must be deployed in a redundant manner (e.g., one per AZ) to avoid a single point of failure, while VPC endpoints improve security but not fault tolerance.

Practice this question →
265
MCQhard

A company runs a critical application on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) in a VPC. The application experiences unpredictable traffic spikes. The company notices that during peak traffic, the ALB returns 503 errors. The network engineer checks the ALB's CloudWatch metrics and sees that the 'ActiveConnectionCount' is high but 'TargetResponseTime' is low. The ALB's target group is configured with a deregistration delay of 300 seconds. The ALB is internet-facing and uses an SSL/TLS certificate from AWS Certificate Manager. The security group for the ALB allows inbound HTTPS from 0.0.0.0/0. The target instances' security group allows inbound traffic from the ALB's security group. The VPC has a CIDR of 10.0.0.0/16 with public and private subnets. The ALB is in public subnets, and the instances are in private subnets. The route tables for private subnets have a default route to a NAT gateway in the public subnets. The company wants to resolve the 503 errors. What should the network engineer do?

A.Disable cross-zone load balancing on the ALB.
B.Increase the deregistration delay to 600 seconds.
C.Increase the idle timeout setting on the ALB to a higher value.
D.Move the ALB to private subnets and use a NAT gateway for internet access.
AnswerC

Higher idle timeout keeps connections alive, reducing connection rate.

Why this answer

The 503 errors are likely caused by the ALB reaching its connection limit (e.g., 50,000 concurrent connections). Increasing the idle timeout would keep connections open longer, increasing concurrent connections and worsening the issue. Decreasing the idle timeout would close idle connections faster, reducing concurrency.

Alternatively, scaling out the target group or adding more ALBs can distribute the load. None of the provided options are correct; the correct action is to reduce the idle timeout or increase the number of targets.

Practice this question →
266
Multi-Selectmedium

A company is designing a network for a critical application that requires low-latency communication between EC2 instances in the same AWS Region. They want to maximize network throughput and minimize latency. Which TWO design choices should they make? (Choose two.)

Select 2 answers
A.Attach an internet gateway to the VPC and route traffic through it.
B.Enable enhanced networking (ENA) on the EC2 instances.
C.Use a VPN connection to route traffic between instances.
D.Use a spread placement group for the EC2 instances.
E.Place the EC2 instances in a cluster placement group.
AnswersB, E

Enhanced networking provides higher bandwidth and lower latency.

Why this answer

Enabling Enhanced Networking (ENA) on EC2 instances provides higher bandwidth, higher packet-per-second (PPS) performance, and consistently lower inter-instance latencies by using a modern network interface driver that offloads network processing to dedicated hardware. This is essential for critical applications requiring maximum throughput and minimal latency within the same AWS Region.

Exam trap

AWS often tests the misconception that spread placement groups improve network performance, when in fact they are designed for high availability and fault tolerance, not low latency or high throughput.

Practice this question →
267
MCQmedium

Refer to the exhibit. A network architect is reviewing an IAM policy for a junior engineer. What is the security concern with this policy?

A.The policy does not include a condition to restrict the actions to specific VPCs
B.The policy allows deletion of VPCs and subnets, which could lead to resource loss
C.The policy allows creation of VPCs and subnets, which could cause resource exhaustion
D.The policy allows read-only actions that could expose sensitive network configurations
AnswerB

Delete actions are destructive.

Why this answer

The IAM policy grants `ec2:DeleteVpc` and `ec2:DeleteSubnet` permissions, which allow the junior engineer to delete VPCs and subnets. This could lead to irreversible resource loss, including all associated resources like route tables, security groups, and network interfaces, disrupting network connectivity and services.

Exam trap

AWS often tests the misconception that allowing creation actions (like `ec2:CreateVpc`) is the primary risk, but the trap here is that destructive actions (like `ec2:DeleteVpc`) pose a more immediate and severe security concern due to potential data loss and service disruption.

How to eliminate wrong answers

Option A is wrong because the policy does not include a condition to restrict actions to specific VPCs, but the primary security concern is the ability to delete resources, not the lack of conditions; conditions are a best practice but not the most immediate risk here. Option C is wrong because while creating VPCs and subnets could cause resource exhaustion, the policy also allows deletion, which poses a more direct risk of data loss and service disruption; resource exhaustion is a potential issue but less critical than destructive actions. Option D is wrong because the policy does not include read-only actions; it includes `ec2:CreateVpc`, `ec2:CreateSubnet`, `ec2:DeleteVpc`, and `ec2:DeleteSubnet`, which are all write or destructive actions, not read-only.

Practice this question →
268
MCQhard

A financial services company must meet PCI DSS compliance for its VPC design. It requires that all traffic between application tiers be encrypted in transit and that no traffic can bypass the encryption. The architecture includes a public-facing Application Load Balancer (ALB), a web tier in public subnets, an app tier in private subnets, and a database tier in isolated subnets. Which design meets these requirements?

A.Terminate TLS at the ALB. Use HTTP between ALB and web tier. Use HTTPS between web and app tier. Use TLS between app and database tier.
B.Terminate TLS at the ALB. Use HTTP between ALB and web tier. Use HTTPS between web and app tier. Use TLS between app and database tier.
C.Terminate TLS at the ALB. Use HTTPS between ALB and web tier. Use TLS mutual authentication between web and app tier. Use TLS between app and database tier.
D.Terminate TLS at the ALB. Use HTTPS between ALB and web tier. Use HTTP between web and app tier. Use TLS between app and database tier.
AnswerC

All traffic is encrypted: ALB to web (HTTPS), web to app (TLS mutual auth), app to database (TLS).

Why this answer

It ensures encryption in transit for all traffic between application tiers, meeting PCI DSS requirements. The ALB terminates TLS from clients, then uses HTTPS (TLS) to the web tier, mutual TLS between web and app tiers for strong authentication and encryption, and TLS between app and database tiers. This design prevents any unencrypted traffic from bypassing encryption, as every hop uses TLS.

Exam trap

The trap here is that candidates may assume terminating TLS at the ALB is sufficient for all internal traffic, overlooking the need for encryption between every tier, especially the web-to-app hop where HTTP is often mistakenly considered acceptable.

How to eliminate wrong answers

Option A is wrong because it uses HTTP between the ALB and web tier, which transmits data in plaintext, violating the requirement that no traffic can bypass encryption. Option B is identical to A and thus also wrong for the same reason. Option D is wrong because it uses HTTP between the web and app tier, leaving that hop unencrypted and failing to meet PCI DSS encryption requirements.

Practice this question →
269
MCQhard

A financial services company must meet PCI DSS compliance requirements. The company's VPC contains a web server in a public subnet and an application server in a private subnet. The application server must communicate with a third-party payment gateway over the internet, but the security team prohibits using an Elastic IP address or a NAT gateway due to auditing concerns. Which solution satisfies these requirements?

A.Deploy a NAT instance in the public subnet and route traffic through it
B.Configure a proxy server in the public subnet and have the application server use the proxy
C.Use AWS PrivateLink to connect to the payment gateway via a VPC Endpoint Service
D.Attach an Internet Gateway to the VPC and use a default route to 0.0.0.0/0 in the private subnet
AnswerC

PrivateLink enables private connectivity to services over the AWS network, avoiding public IPs and internet transit, meeting compliance requirements.

Why this answer

AWS PrivateLink allows the application server in the private subnet to connect to the third-party payment gateway via a VPC Endpoint Service without traversing the internet, using private IP addresses. This eliminates the need for an Elastic IP address or a NAT gateway, satisfying the security team's auditing concerns while meeting PCI DSS compliance requirements.

Exam trap

The trap here is that candidates often assume a NAT gateway or proxy is required for outbound internet access, but PrivateLink provides a private, internet-free connection to third-party services, directly addressing the auditing and compliance constraints.

How to eliminate wrong answers

Option A is wrong because a NAT instance requires an Elastic IP address to provide outbound internet access, which is explicitly prohibited by the security team. Option B is wrong because a proxy server in the public subnet still requires an Elastic IP address or a NAT gateway for outbound connectivity, and it does not eliminate the auditing concerns. Option D is wrong because attaching an Internet Gateway and adding a default route to 0.0.0.0/0 in the private subnet would route traffic directly to the internet, but private subnets cannot route to an Internet Gateway without a NAT device or Elastic IP; this configuration would fail to provide outbound connectivity and violates the security team's requirements.

Practice this question →
270
MCQhard

A company has a VPC with CIDR 10.0.0.0/16. They have an on-premises network with CIDR 172.16.0.0/12 connected via AWS Site-to-Site VPN. The company also has a second VPC (VPC B) with CIDR 10.1.0.0/16 peered with the first VPC. They notice that instances in VPC B cannot reach the on-premises network. What is the most likely cause?

A.Route propagation is disabled in VPC B.
B.The VPN connection is not compatible with VPC peering.
C.The VPN tunnel is down.
D.VPC peering does not support transitive routing.
AnswerD

Transitive routing is not supported; on-premises cannot reach VPC B through VPC peering.

Why this answer

VPC peering does not support transitive routing. This means that if VPC A is peered with VPC B and also connected to an on-premises network via VPN, traffic from VPC B cannot use VPC A as a transit point to reach the on-premises network. Each VPC must have its own direct connection to the on-premises network, or a transit gateway must be used to enable transitive routing.

Exam trap

The trap here is that candidates often assume VPC peering works like a router or a hub-and-spoke model, not realizing that AWS explicitly disables transitive routing across VPC peering connections to prevent unintended network loops and complexity.

How to eliminate wrong answers

Option A is wrong because route propagation in VPC B is irrelevant; even if VPC B had propagated routes from the VPN, the VPC peering connection itself does not allow traffic to be forwarded from VPC B through VPC A to the on-premises network due to the lack of transitive routing. Option B is wrong because the VPN connection is fully compatible with VPC peering; the issue is not compatibility but the architectural limitation that VPC peering does not support transitive routing. Option C is wrong because if the VPN tunnel were down, instances in VPC A would also be unable to reach the on-premises network, but the problem is specific to VPC B, indicating the VPN is operational.

Practice this question →
271
MCQmedium

A company is designing a multi-region architecture with an active-active setup. They need to route traffic to the nearest healthy endpoint. Which AWS service should they use?

A.Application Load Balancer (ALB)
B.Amazon Route 53 latency-based routing
C.AWS Global Accelerator
D.Amazon CloudFront
AnswerB

Route 53 latency-based routing directs traffic to the region with the lowest latency for the user.

Why this answer

Amazon Route 53 latency-based routing directs traffic to the AWS Region that provides the lowest latency for the end user, based on measurements between the user's DNS resolver and AWS endpoints. It also supports health checks, automatically excluding unhealthy endpoints from the routing pool, which enables an active-active multi-region architecture by routing each request to the nearest healthy endpoint. AWS Global Accelerator also routes to the nearest healthy endpoint but uses anycast IPs at the network layer, making it more suitable for optimizing TCP/UDP traffic rather than general DNS-level routing.

Exam trap

The ANS-C01 exam often tests the distinction between DNS-based routing (Route 53 latency routing) and network-layer anycast routing (Global Accelerator). Candidates might mistakenly choose Global Accelerator because it also routes to the nearest endpoint via anycast, but Route 53 latency routing is correct for scenarios that do not require static IPs or TCP/UDP optimization.

How to eliminate wrong answers

Option A is wrong because an Application Load Balancer (ALB) operates within a single AWS Region and cannot route traffic across multiple regions or select the nearest healthy endpoint globally. Option C is wrong because AWS Global Accelerator uses Anycast IPs and the AWS global network to route traffic to the nearest healthy endpoint, but it is designed for TCP/UDP traffic and provides static IP addresses, not DNS-based latency routing; while it can achieve similar goals, the question specifically asks for a service that routes traffic to the nearest healthy endpoint via DNS, which is Route 53 latency-based routing. Option D is wrong because Amazon CloudFront is a content delivery network (CDN) optimized for caching and delivering static and dynamic web content at edge locations, not for routing general application traffic to the nearest healthy origin endpoint based on latency measurements.

Practice this question →
272
Multi-Selectmedium

A company is designing a network for a critical application that requires maximum availability. The application will be deployed across multiple Availability Zones in a single region. Which THREE design choices improve network availability?

Select 3 answers
A.Use an Application Load Balancer with targets in multiple Availability Zones
B.Deploy EC2 instances in at least two Availability Zones
C.Use a single NAT gateway in one Availability Zone
D.Use a single subnet per Availability Zone
E.Use multiple NAT gateways, one in each Availability Zone
AnswersA, B, E

Distributes traffic across AZs.

Why this answer

An Application Load Balancer (ALB) with targets in multiple Availability Zones (AZs) improves availability by distributing incoming traffic across healthy targets in different AZs. If one AZ fails, the ALB automatically routes traffic to targets in the remaining AZs, ensuring the application remains accessible. This design eliminates a single point of failure at the load balancer level and leverages the regional nature of the ALB to provide cross-AZ fault tolerance.

Exam trap

AWS often tests the misconception that a single NAT gateway is sufficient for high availability because it can route traffic from multiple AZs, but the trap here is that the NAT gateway itself is a zonal resource—if its AZ fails, all outbound traffic is lost, making it a critical single point of failure.

Practice this question →
273
MCQmedium

A company is designing a hybrid network architecture that connects an on-premises data center to AWS using AWS Direct Connect. The company requires high availability and uses BGP for dynamic routing. The on-premises router supports BGP multipath. Which configuration ensures the highest availability for the Direct Connect connection?

A.Provision two Direct Connect connections to two different Direct Connect locations and configure BGP multipath.
B.Provision a single Direct Connect connection and a Site-to-Site VPN as a backup.
C.Provision a single Direct Connect connection with two virtual interfaces.
D.Provision a single Direct Connect connection with multiple VLANs.
AnswerA

Physical diversity ensures high availability.

Why this answer

Provisioning two Direct Connect connections to two different Direct Connect locations eliminates single points of failure at the physical layer and the facility level. BGP multipath allows the on-premises router to load-balance traffic across both connections, maximizing availability by ensuring that if one connection or location fails, traffic continues over the other without relying on a slower failover mechanism like VPN.

Exam trap

The trap here is that candidates often confuse logical redundancy (multiple VLANs or virtual interfaces) with physical redundancy, assuming that multiple logical constructs on a single physical connection provide high availability, when in fact a single physical failure will take down all logical constructs.

How to eliminate wrong answers

Option B is wrong because a Site-to-Site VPN over the internet introduces latency, jitter, and potential bandwidth limitations, and it is typically used as a backup only when Direct Connect is unavailable, not as a primary high-availability solution; it does not provide the same SLA or consistent performance as a second Direct Connect. Option C is wrong because a single Direct Connect connection with two virtual interfaces still shares the same physical port, fiber path, and Direct Connect location, meaning a single failure at the physical layer (e.g., fiber cut, device failure) will bring down both virtual interfaces, violating high availability. Option D is wrong because multiple VLANs on a single Direct Connect connection are used to segregate traffic (e.g., public vs. private VIFs) but do not provide redundancy; they all depend on the same physical connection and location, so a single failure disrupts all VLANs.

Practice this question →
274
MCQeasy

A company needs to establish private connectivity between two VPCs in different AWS accounts. The VPCs are in the same Region. Which AWS feature should be used?

A.AWS Transit Gateway
B.AWS Direct Connect
C.VPC peering
D.AWS Site-to-Site VPN
AnswerC

VPC peering enables private connectivity between VPCs across accounts.

Why this answer

VPC peering is the correct choice because it establishes a direct, private network connection between two VPCs in the same AWS Region, even across different AWS accounts, using the AWS backbone without requiring a transit hub or external connectivity. It leverages the existing AWS infrastructure to route traffic between the VPCs via private IPv4 or IPv6 addresses, with no bandwidth bottlenecks or single points of failure inherent in the design.

Exam trap

The trap here is that candidates often choose AWS Transit Gateway because they think it is required for cross-account connectivity, but VPC peering directly supports cross-account VPC connections in the same Region without needing a central hub.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway is a hub-and-spoke architecture designed for connecting many VPCs and on-premises networks, which introduces additional cost and complexity for a simple two-VPC scenario where VPC peering is more straightforward and cost-effective. Option B is wrong because AWS Direct Connect provides dedicated private connectivity from an on-premises data center to AWS, not between two VPCs within the same Region; it requires physical infrastructure and is not designed for VPC-to-VPC peering. Option D is wrong because AWS Site-to-Site VPN establishes encrypted tunnels over the public internet to connect on-premises networks to AWS, not for direct VPC-to-VPC connectivity; using it for VPC peering would introduce unnecessary latency and complexity.

Practice this question →
275
MCQmedium

A company has a hub-and-spoke network topology using AWS Transit Gateway in us-east-1. The hub VPC hosts centralized inspection appliances from a third-party vendor. The spokes include VPCs with application workloads and a Direct Connect VIF attached to a Direct Connect gateway which is associated with the Transit Gateway. The company notices that traffic from the on-premises network to the spoke VPCs is not being inspected by the centralized appliances. They have verified that the Transit Gateway route tables are correctly configured with static routes pointing to the inspection VPC for all spoke CIDRs, and the inspection appliances are properly configured to forward traffic. What is the most likely cause of this issue?

A.The Direct Connect gateway is not propagating routes to the Transit Gateway, causing the on-premises traffic to be dropped.
B.The Transit Gateway route table associated with the Direct Connect gateway attachment does not have a route that sends traffic to the inspection VPC.
C.The inspection VPC is sending traffic back to the on-premises network via a different path, causing asymmetric routing that drops packets.
D.The Transit Gateway route table for the spoke VPC attachments does not have a route to the on-premises network via the Direct Connect gateway.
AnswerB

The route table associated with the attachment determines the path. Without a specific route to the inspection VPC, traffic goes directly to the spoke.

Why this answer

In a hub-and-spoke topology with AWS Transit Gateway, traffic from on-premises (via Direct Connect) to spoke VPCs must be routed through the inspection VPC. This requires the Transit Gateway route table associated with the Direct Connect gateway attachment to contain a static route pointing to the inspection VPC attachment for the spoke CIDRs. Without this route, traffic bypasses inspection entirely.

Exam trap

The trap here is that candidates assume configuring routes in the spoke VPC route tables or the inspection VPC is sufficient, but they overlook that the Transit Gateway route table associated with the Direct Connect gateway attachment must also direct traffic to the inspection VPC.

How to eliminate wrong answers

Option A is wrong because the Direct Connect gateway does not propagate routes to the Transit Gateway; instead, the Transit Gateway must have static routes or propagated routes from the Direct Connect gateway, and the issue is not about propagation but about missing inspection routes. Option C is wrong because asymmetric routing is not the primary cause; the problem is that traffic never reaches the inspection VPC in the first place, so asymmetric routing is irrelevant. Option D is wrong because the spoke VPC route tables do not need a route to on-premises via the Direct Connect gateway; the Transit Gateway handles inter-VPC routing, and the spoke attachments only need routes to the inspection VPC for return traffic, which is already configured.

Practice this question →
276
MCQhard

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The company wants to add a second VPC in the same AWS Region using the same Direct Connect connection. Which solution meets the requirements with the least operational effort?

A.Create a Direct Connect gateway and associate both VPCs, then associate the private VIF with the Direct Connect gateway
B.Set up a VPN connection over the Direct Connect for the second VPC
C.Create a transit virtual interface and attach it to a transit gateway, then attach both VPCs
D.Create a second private virtual interface for the second VPC
AnswerA

Allows multiple VPCs to use the same private VIF via the Direct Connect gateway.

Why this answer

A Direct Connect gateway allows a single private virtual interface (VIF) to connect to multiple VPCs in the same AWS Region, eliminating the need for multiple VIFs or complex routing. By associating both VPCs with the Direct Connect gateway and attaching the private VIF to it, you achieve the goal with minimal operational overhead, as the gateway handles the routing between the on-premises network and the VPCs.

Exam trap

AWS often tests the misconception that a single private VIF can only connect to one VPC, leading candidates to choose Option D, but the Direct Connect gateway enables multi-VPC connectivity with the same VIF.

How to eliminate wrong answers

Option B is wrong because setting up a VPN over Direct Connect adds unnecessary complexity and operational effort, as it requires managing VPN tunnels and encryption, whereas a Direct Connect gateway provides a simpler native solution. Option C is wrong because a transit virtual interface is used with a transit gateway for connecting multiple VPCs or VPNs, but it requires creating a transit gateway and additional configuration, which is more effort than using a Direct Connect gateway with existing private VIF. Option D is wrong because creating a second private virtual interface would require additional Direct Connect configuration and potentially more bandwidth allocation, increasing operational effort compared to reusing the existing VIF via a Direct Connect gateway.

Practice this question →
277
MCQhard

Refer to the exhibit. A developer created this CloudFormation template to create a public subnet. However, instances in the subnet cannot access the internet. What is the MOST likely cause?

A.The subnet does not have auto-assign public IP enabled
B.The route to the internet gateway is missing
C.The route table is not associated with the subnet
D.The internet gateway is not attached to the VPC
AnswerA

Instances need public IPs for internet access; template does not enable it.

Why this answer

The CloudFormation template creates a public subnet but does not set the 'MapPublicIpOnLaunch' property to 'true'. Without this setting, EC2 instances launched in the subnet do not automatically receive a public IPv4 address, which is required for internet-bound traffic to be routed through the Internet Gateway (IGW). Even if the route table has a default route (0.0.0.0/0) pointing to the IGW, the instance lacks a public IP, so the IGW cannot perform source NAT for outbound traffic, making internet access impossible.

Exam trap

AWS often tests the misconception that a default route to an IGW alone guarantees internet access, but the trap here is that the instance must have a public IP address for the IGW to perform source NAT, and auto-assign public IP is disabled by default in CloudFormation unless explicitly enabled.

How to eliminate wrong answers

Option B is wrong because the route to the internet gateway is not missing; the template explicitly includes a route in the public route table with destination 0.0.0.0/0 and target referencing the Internet Gateway. Option C is wrong because the route table is associated with the subnet via the 'AWS::EC2::SubnetRouteTableAssociation' resource in the template. Option D is wrong because the Internet Gateway is created and attached to the VPC using the 'AWS::EC2::VPCGatewayAttachment' resource, so the attachment is present.

Practice this question →
278
MCQeasy

A company has a VPC with public and private subnets in three Availability Zones. The company hosts a web application on Amazon EC2 instances in the private subnets. The instances need to download security patches from the internet but must not be directly accessible from the internet. Which solution meets these requirements with the least operational overhead?

A.Deploy a NAT instance in a public subnet and configure the private subnet route tables to point to the NAT instance.
B.Attach an internet gateway to the VPC and add a default route to the internet gateway in the private subnet route tables.
C.Create a VPC endpoint for Amazon S3 and configure the instances to use the endpoint.
D.Deploy a NAT gateway in each public subnet and configure the private subnet route tables to point to the respective NAT gateway.
AnswerD

Managed service, highly available, minimal operational overhead.

Why this answer

A NAT gateway is a fully managed AWS service that provides outbound internet connectivity for instances in private subnets while preventing inbound internet access. Deploying a NAT gateway in each public subnet across three Availability Zones ensures high availability and fault tolerance, and configuring private subnet route tables with a default route (0.0.0.0/0) pointing to the respective NAT gateway meets the requirement with minimal operational overhead, as AWS handles patching and scaling.

Exam trap

AWS often tests the distinction between managed NAT gateways and self-managed NAT instances, where candidates may choose the NAT instance option (A) due to lower cost, overlooking the 'least operational overhead' requirement, or they may incorrectly select the VPC endpoint option (C) thinking it provides general internet access.

How to eliminate wrong answers

Option A is wrong because a NAT instance is a self-managed EC2 instance that requires ongoing maintenance, patching, and scaling, which increases operational overhead compared to a managed NAT gateway. Option B is wrong because attaching an internet gateway and adding a default route to it in private subnet route tables would make the instances directly accessible from the internet, violating the requirement that instances must not be directly accessible. Option C is wrong because a VPC endpoint for Amazon S3 only provides private connectivity to S3, not general internet access for downloading security patches from arbitrary internet sources.

Practice this question →
279
MCQeasy

A company is deploying a hybrid network with AWS Direct Connect and a VPN backup. The Direct Connect virtual interface is configured for private VIF with BGP. The VPN uses IPsec tunnels over the internet. What is the best practice to ensure symmetric routing and failover?

A.Configure ASN prepending on the VPN BGP advertisements to make them less preferred.
B.Use different BGP ASNs for Direct Connect and VPN to allow AWS to prefer the Direct Connect path.
C.Disable BGP on the Direct Connect private VIF and use static routes to force traffic through Direct Connect.
D.Use the same BGP ASN for both Direct Connect and VPN, and set a higher MED (Multi-Exit Discriminator) on the VPN routes.
AnswerD

Same ASN ensures AWS sees both as same neighbor, and MED controls preference.

Why this answer

Using the same BGP ASN for both Direct Connect and VPN, and setting a higher MED on the VPN routes, ensures symmetric routing by making the Direct Connect path more preferred. AWS uses the BGP AS_PATH length as a tie-breaker; with the same ASN, the paths are equal in AS_PATH length, so MED is evaluated. A higher MED on the VPN routes causes AWS to prefer the Direct Connect path, and if Direct Connect fails, the VPN routes (with higher MED) become active, providing failover.

Exam trap

The trap here is that candidates often assume different ASNs are required for path preference, but AWS mandates the same ASN for private VIF and VPN to prevent BGP loop detection, and MED is the correct mechanism to influence inbound traffic preference.

How to eliminate wrong answers

Option A is wrong because ASN prepending on the VPN BGP advertisements would artificially lengthen the AS_PATH, making the VPN path less preferred, but this does not guarantee symmetric routing because AWS may still see the Direct Connect path as equal or prefer it based on other attributes; moreover, ASN prepending is typically used to influence outbound traffic from on-premises, not inbound traffic from AWS. Option B is wrong because using different BGP ASNs for Direct Connect and VPN would cause AWS to prefer the path with the shorter AS_PATH (Direct Connect), but this can lead to asymmetric routing if the on-premises router prefers the VPN for return traffic; also, AWS requires the same ASN for private VIFs and VPN attachments to avoid BGP loop prevention issues. Option C is wrong because disabling BGP on the Direct Connect private VIF and using static routes removes dynamic failover capabilities and BGP health checking, making the solution brittle; static routes cannot adapt to link failures, and AWS does not support static routes on private VIFs for route propagation.

Practice this question →
280
MCQhard

A company has a VPC with a CIDR block of 10.0.0.0/16. It has a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to ensure that traffic to S3 does not traverse the internet. Which solution should be used?

A.Create a VPC Interface Endpoint for S3 and associate it with the private subnet
B.Create a NAT Gateway in the public subnet and add a route in the private subnet route table pointing to the NAT Gateway
C.Create a VPC Gateway Endpoint for S3 and add a route in the private subnet route table pointing to the endpoint
D.Set up an AWS Direct Connect connection and use a private virtual interface
AnswerC

Gateway Endpoint provides private access to S3.

Why this answer

A VPC Gateway Endpoint for S3 allows private subnet resources to access S3 without traversing the internet, using AWS's internal network. By adding a route in the private subnet's route table pointing to the gateway endpoint (prefix list for S3), traffic destined for S3 stays within the AWS network, meeting the requirement to avoid internet transit.

Exam trap

The trap here is that candidates confuse Interface Endpoints (powered by AWS PrivateLink) with Gateway Endpoints, assuming S3 supports Interface Endpoints, but S3 only supports Gateway Endpoints (and later, Gateway Load Balancer endpoints, not Interface Endpoints).

How to eliminate wrong answers

Option A is wrong because a VPC Interface Endpoint for S3 is not supported; S3 only supports Gateway Endpoints (and later, Gateway Load Balancer endpoints, but not Interface Endpoints). Option B is wrong because a NAT Gateway routes traffic through the internet, which violates the requirement that traffic to S3 does not traverse the internet. Option D is wrong because AWS Direct Connect is an over-engineered solution for simple S3 access; it incurs additional cost and complexity, and does not inherently prevent traffic from traversing the internet unless combined with a VPC endpoint, making it unnecessary for this use case.

Practice this question →
281
Multi-Selectmedium

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) in a VPC. They need to ensure that the application can handle a sudden increase in traffic and that the ALB can scale automatically. Which TWO actions should they take? (Choose two.)

Select 2 answers
A.Configure the target group's deregistration delay to a low value to quickly remove unhealthy targets.
B.Use a single subnet for the ALB to reduce complexity.
C.Use a Network Load Balancer instead of an ALB to improve throughput.
D.Enable cross-zone load balancing on the ALB.
E.Disable deletion protection on the ALB to allow automatic replacement.
AnswersA, D

A low deregistration delay ensures that unhealthy instances are removed quickly, preventing them from receiving traffic.

Why this answer

Configuring a low deregistration delay on the target group allows the ALB to quickly stop sending traffic to unhealthy targets, reducing the risk of failed requests during traffic spikes. This setting controls how long the ALB waits for in-flight requests to complete before deregistering a target, and a lower value accelerates the removal of unhealthy instances to maintain application responsiveness. Option D is correct because enabling cross-zone load balancing distributes incoming traffic evenly across all healthy targets in all Availability Zones, maximizing resource utilization and ensuring the ALB can scale automatically by leveraging capacity from multiple zones.

Exam trap

AWS often tests the misconception that enabling cross-zone load balancing is optional or unnecessary for high availability, when in fact it is a critical feature for distributing traffic evenly and supporting automatic scaling across zones.

Practice this question →
282
MCQmedium

A company is designing a multi-Region Active-Active architecture using Application Load Balancers (ALBs) behind AWS Global Accelerator. The application requires sticky sessions (session affinity) and must maintain session persistence even during failover. Which configuration should be used to achieve this?

A.Enable stickiness on each ALB individually and use a single Regional endpoint group.
B.Configure Global Accelerator to use session affinity with the 'two-tuple' protocol.
C.Configure Route 53 with latency-based routing and enable stickiness on each ALB.
D.Use a custom application cookie for stickiness that is consistent across all ALBs, and set the cookie domain to the Global Accelerator DNS name.
AnswerD

A custom cookie with a shared domain allows session persistence across ALBs in different Regions.

Why this answer

AWS Global Accelerator does not natively support session affinity (sticky sessions). To maintain session persistence across multi-Region ALBs during failover, you must use a custom application cookie that is consistent across all ALBs and set the cookie domain to the Global Accelerator DNS name. This ensures the client's browser sends the same cookie to any healthy ALB in any Region, preserving the session even when traffic shifts due to a failover.

Exam trap

The trap here is that candidates assume Global Accelerator can provide session affinity natively, similar to an ALB's stickiness feature, but Global Accelerator is a Layer 3/4 service and cannot maintain application-layer session state; the solution requires a custom cookie approach at the application level.

How to eliminate wrong answers

Option A is wrong because using a single Regional endpoint group defeats the purpose of a multi-Region Active-Active architecture; it would not provide cross-Region failover. Option B is wrong because Global Accelerator does not support session affinity with any tuple (two-tuple, three-tuple, or five-tuple); it is a network-layer service that does not maintain session state. Option C is wrong because Route 53 latency-based routing does not provide the fast failover and client IP preservation that Global Accelerator offers, and enabling stickiness on each ALB individually does not ensure session persistence across Regions during failover.

Practice this question →
283
MCQmedium

A company is deploying a critical application across multiple Availability Zones in a single AWS Region. They need a network design that provides the lowest possible latency between application tiers and supports automatic failover if an AZ becomes unavailable. Which design meets these requirements?

A.Use Amazon Route 53 weighted routing to distribute traffic to each AZ
B.Deploy an internal NLB per Availability Zone, with each NLB only registering targets in its own AZ, and an internet-facing Application Load Balancer (ALB) with targets in all AZs
C.Use a single internal Classic Load Balancer across all AZs
D.Deploy an internal Network Load Balancer (NLB) in a single AZ and route traffic from other AZs through it
AnswerB

This keeps traffic within the AZ for lowest latency, and the ALB provides failover across AZs.

Why this answer

Deploying an internal NLB per Availability Zone ensures cross-zone traffic is minimized, reducing latency between application tiers, while the internet-facing ALB provides automatic failover by distributing incoming traffic across healthy targets in all AZs. The NLB's per-AZ design keeps traffic within the same AZ for internal communication, and the ALB's health checks enable automatic rerouting if an AZ becomes unavailable.

Exam trap

The trap here is that candidates often assume a single load balancer across all AZs is sufficient for low latency, but they overlook that cross-AZ traffic adds latency and that per-AZ NLBs with cross-zone load balancing disabled are required to keep traffic local.

How to eliminate wrong answers

Option A is wrong because Route 53 weighted routing operates at the DNS level and does not provide automatic failover within the same region; it requires manual intervention or health checks with failover routing, and it adds DNS resolution latency that is not suitable for low-latency inter-tier traffic. Option C is wrong because a single Classic Load Balancer across all AZs does not minimize latency (it may route traffic across AZs) and Classic Load Balancers lack advanced features like cross-zone load balancing control and are deprecated for new deployments. Option D is wrong because deploying a single NLB in one AZ creates a single point of failure and forces cross-AZ traffic for all requests, increasing latency and violating the automatic failover requirement.

Practice this question →
284
MCQmedium

A company has a multi-tier web application running on EC2 instances in a VPC. The web tier must be accessible from the internet, but the application tier should only be accessible from the web tier. Which network design configuration meets these requirements?

A.Use a VPN connection from the web tier to the application tier, and place both tiers in private subnets.
B.Place both tiers in public subnets and use security groups to restrict traffic from the web tier to the application tier.
C.Place web servers in a public subnet with a NAT gateway, and application servers in a private subnet with a default route to the NAT gateway.
D.Place web servers in a public subnet with an internet gateway, and application servers in a private subnet with a route to the web subnet via a VPC peering connection.
AnswerB

Public subnets expose both tiers to the internet, increasing attack surface.

Why this answer

Placing both tiers in public subnets with an internet gateway allows the web tier to be accessible from the internet. Security groups can then be used to restrict inbound traffic to the application tier to only come from the web tier's security group, ensuring that the application tier is not directly accessible from the internet. This design meets the requirement without unnecessary complexity.

Exam trap

The trap is that candidates may think a private subnet is required for the application tier, but security groups can provide sufficient isolation even in public subnets. Alternatively, they may incorrectly choose D because it mentions a private subnet, not realizing that VPC peering is for connecting separate VPCs, not subnets within the same VPC.

How to eliminate wrong answers

Option A is wrong because a VPN connection is typically used for site-to-site or remote access, not for routing traffic between tiers within the same VPC; placing both tiers in private subnets would block internet access to the web tier. Option B is wrong because placing both tiers in public subnets exposes the application tier to the internet, violating the requirement that it should only be accessible from the web tier. Option C is wrong because a NAT gateway provides outbound internet access for private instances, not inbound access; the web tier in a public subnet would need an internet gateway, and the default route to the NAT gateway does not enable the web tier to initiate traffic to the application tier in a private subnet without additional routing.

Practice this question →
285
MCQeasy

A company wants to improve disaster recovery by replicating data between two AWS Regions. Which AWS service provides a managed solution for cross-Region network connectivity?

A.AWS Direct Connect
B.VPC Peering
C.AWS Site-to-Site VPN
D.AWS Global Accelerator
AnswerB

VPC Peering supports cross-Region connectivity, providing a managed, private network path for data replication between VPCs in different Regions.

Why this answer

VPC Peering supports cross-Region connections, enabling direct network connectivity between VPCs in different AWS Regions. This allows data replication without traversing the public internet, providing low-latency, private connectivity. AWS Global Accelerator is for traffic optimization and failover, not for direct connectivity for data replication.

Exam trap

The ANS-C01 exam often tests that VPC Peering supports cross-Region connectivity, which is a managed solution for inter-Region data replication. Candidates may incorrectly choose Global Accelerator, which is for improving application performance and availability, not for establishing direct network paths for data replication.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect establishes dedicated private connections from on-premises to AWS, but it does not inherently provide managed cross-Region connectivity between two AWS Regions. Option B is wrong because VPC Peering connects VPCs within the same or different Regions but requires manual setup, does not support transitive routing, and is not a managed service for cross-Region replication. Option C is wrong because AWS Site-to-Site VPN creates encrypted tunnels between on-premises networks and AWS, but it is not designed for direct cross-Region connectivity between AWS Regions and lacks the global optimization and failover features of Global Accelerator.

Practice this question →
286
MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). They launch an EC2 instance in subnet A and another in subnet B. The security groups for both instances allow all traffic from the other instance's private IP. However, the instances cannot communicate. What is the most likely cause?

A.The instances are in different Availability Zones
B.The network ACLs are blocking the traffic
C.The security groups are stateful and block return traffic
D.The route tables do not have a local route
AnswerB

NACLs are stateless and need to allow both outbound and inbound traffic for each direction.

Why this answer

The most likely cause is that the network ACLs (NACLs) are blocking the traffic. Security groups are stateful and allow return traffic automatically, but NACLs are stateless and require explicit inbound and outbound rules for both directions. By default, custom NACLs deny all traffic, so even though the security groups permit communication, the NACLs on subnets A and B must allow the traffic.

The correct answer is B.

Exam trap

The trap here is that candidates often assume security groups are the only firewall layer or forget that NACLs are stateless and require explicit rules for both directions, leading them to overlook NACL misconfigurations when security groups appear permissive.

How to eliminate wrong answers

Option A is wrong because instances in different Availability Zones can communicate within the same VPC as long as routing and security rules permit; AZ placement does not inherently block traffic. Option C is wrong because security groups are stateful, meaning they automatically allow return traffic for permitted outbound connections, so they do not block return traffic. Option D is wrong because VPCs automatically have a local route in the main route table for the VPC CIDR (10.0.0.0/16), enabling communication between subnets without additional routes.

Practice this question →
287
MCQhard

A company designs a multi-account AWS environment using AWS Organizations. The networking team wants a centralized inspection VPC for traffic between VPCs and on-premises. Which architecture ensures that all inter-VPC traffic passes through the inspection VPC?

A.VPC peering between all VPCs and the inspection VPC.
B.AWS Network Firewall deployed in each VPC.
C.AWS Transit Gateway with centralized routing to the inspection VPC.
D.AWS Direct Connect Gateway with virtual interfaces.
AnswerC

Centralized routing enforces inspection.

Why this answer

AWS Transit Gateway enables centralized routing by attaching all VPCs and the on-premises network to a single transit gateway, then configuring route tables to force all inter-VPC traffic through a dedicated inspection VPC appliance (e.g., firewall or NGFW). This ensures traffic flows via the inspection VPC without requiring full-mesh peering or per-VPC firewalls.

Exam trap

The trap here is that candidates often confuse VPC peering with transitive routing, assuming that peering multiple VPCs to a central VPC automatically routes traffic through it, but VPC peering does not support transitive routing—each peering connection is non-transitive, so traffic between two spoke VPCs would not go through the central VPC unless explicit routing is configured, which is complex and not natively supported.

How to eliminate wrong answers

Option A is wrong because VPC peering creates direct, one-to-one connections between VPCs; traffic between peered VPCs does not traverse a central inspection point unless explicitly routed through an intermediate VPC, which would require complex transitive routing that VPC peering does not support (no transitive peering). Option B is wrong because AWS Network Firewall deployed in each VPC only inspects traffic entering or leaving that specific VPC; it does not force inter-VPC traffic to pass through a centralized inspection VPC, as traffic can still flow directly via peering or transit gateway without being routed through the inspection VPC. Option D is wrong because AWS Direct Connect Gateway is used to connect on-premises networks to multiple VPCs via Direct Connect, but it does not provide centralized routing or inspection for inter-VPC traffic; it only extends connectivity from on-premises to VPCs, not between VPCs.

Practice this question →
288
MCQmedium

A company is using AWS Transit Gateway to connect multiple VPCs. They notice that traffic between two VPCs in different Availability Zones is taking a suboptimal path, resulting in cross-AZ data transfer costs. How can they optimize the path and reduce costs?

A.Replace Transit Gateway with VPC Peering between the VPCs.
B.Use Availability Zone affinity by launching resources in the same AZ and using Transit Gateway to route within the same AZ.
C.Enable Transit Gateway multicast to replicate traffic across AZs.
D.Configure the Transit Gateway to use a single Availability Zone for all attachments.
AnswerB

Correct: Keeps traffic within AZ, avoiding cross-AZ charges.

Why this answer

Configuring resources in the same Availability Zone (AZ) and using Transit Gateway to route within that AZ eliminates cross-AZ data transfer costs. AWS Transit Gateway charges for cross-AZ traffic, so keeping traffic local to a single AZ avoids these charges while still leveraging Transit Gateway for centralized routing.

Exam trap

The trap here is that candidates confuse Transit Gateway's regional nature with AZ-specific routing, assuming that Transit Gateway can be pinned to a single AZ, when in fact it always routes traffic through the AZ of the attachment's ENI, and cross-AZ costs are incurred unless resources are in the same AZ.

How to eliminate wrong answers

Option A is wrong because replacing Transit Gateway with VPC Peering does not inherently optimize the path or reduce costs; VPC Peering also incurs cross-AZ data transfer charges and lacks centralized routing, making it a less scalable solution. Option C is wrong because Transit Gateway multicast is designed for one-to-many traffic replication (e.g., streaming media) and does not address suboptimal routing or cross-AZ costs for unicast traffic between two VPCs. Option D is wrong because configuring Transit Gateway to use a single Availability Zone for all attachments is not supported; Transit Gateway is a regional service that operates across all AZs in a region, and attachments are inherently AZ-aware, so this configuration is invalid and would break connectivity.

Practice this question →
289
MCQmedium

A company has a VPC with CIDR 172.16.0.0/16. They have two subnets: 172.16.1.0/24 (public) and 172.16.2.0/24 (private) in us-west-2a. They have an EC2 instance in the private subnet that needs to access an S3 bucket for log uploads. The company wants to avoid using a NAT Gateway to reduce costs. The S3 bucket is in the same region. Which solution should the network engineer implement?

A.Assign an IAM instance profile to the EC2 instance that allows S3 access.
B.Set up a VPN connection from the VPC to the S3 bucket.
C.Create a VPC Gateway Endpoint for S3 and add a route from the private subnet to the endpoint.
D.Create an S3 access point and configure the VPC to use it.
AnswerC

A gateway endpoint provides private connectivity to S3 without a NAT.

Why this answer

A VPC Gateway Endpoint for S3 allows private subnet resources to access S3 without traversing the internet or requiring a NAT Gateway. The endpoint uses AWS PrivateLink to route traffic directly to S3 over the AWS network, and you must add a route in the private subnet's route table pointing to the endpoint (prefix list ID) to enable connectivity.

Exam trap

AWS often tests the misconception that an IAM role alone provides network access, but the trap here is that private subnets require a route to S3, and without a NAT Gateway or VPC endpoint, traffic cannot leave the subnet even with correct IAM permissions.

How to eliminate wrong answers

Option A is wrong because an IAM instance profile grants permissions but does not provide network connectivity; the EC2 instance still needs a route to reach S3, and without a NAT Gateway or VPC endpoint, traffic from a private subnet cannot reach S3. Option B is wrong because a VPN connection is used to connect on-premises networks to a VPC, not to access AWS services like S3; S3 does not support VPN termination. Option D is wrong because an S3 access point is a feature for managing data access with specific policies and network controls, but it does not create a network path; you still need a VPC endpoint or other connectivity to route traffic from the private subnet to the access point.

Practice this question →
290
Multi-Selectmedium

A company has a VPC with public and private subnets. The private subnets must access an S3 bucket without traversing the internet. Which TWO methods can achieve this? (Choose TWO.)

Select 2 answers
A.Attach an internet gateway to the VPC and route traffic through it.
B.Create a VPC gateway endpoint for S3 and associate it with the private subnet route tables.
C.Set up a VPN connection to the on-premises network and access S3 from there.
D.Use AWS PrivateLink to create a VPC endpoint for the S3 bucket.
E.Place a NAT gateway in the public subnet and route traffic through it.
AnswersB, D

Gateway endpoint provides private access to S3.

Why this answer

A VPC gateway endpoint for S3 uses AWS's internal network to route traffic to S3 without traversing the internet. This endpoint is a horizontally scaled, redundant, and highly available gateway that is added to the route table of the private subnets, enabling direct, private connectivity to S3.

Exam trap

The trap here is that candidates often confuse gateway endpoints with interface endpoints (PrivateLink) or assume that a NAT gateway provides private connectivity, when in fact both gateway endpoints and PrivateLink can achieve private S3 access, but only gateway endpoints are free and do not require an ENI in the subnet.

Practice this question →
291
MCQmedium

A company is designing a network for a containerized microservices application running on Amazon ECS. The application consists of several microservices that need to communicate with each other. The company wants to use service discovery so that services can find each other by name. They also want to ensure that traffic between services is encrypted in transit. The microservices are deployed across multiple Availability Zones. Which combination of services should the company use?

A.Use AWS Cloud Map for service discovery and AWS App Mesh for encryption in transit
B.Use an Application Load Balancer for each service and configure HTTPS listeners
C.Use VPC peering between each service's VPC
D.Use Amazon Route 53 private hosted zones for service discovery and enable encryption at the application layer
AnswerA

Cloud Map provides service discovery; App Mesh provides encryption.

Why this answer

AWS Cloud Map provides service discovery by registering microservices with DNS names and health checks, allowing ECS tasks to resolve each other by name. AWS App Mesh uses Envoy sidecar proxies to enforce mutual TLS (mTLS) encryption between services, ensuring traffic is encrypted in transit without requiring changes to application code. This combination meets the requirements for name-based discovery and encrypted inter-service communication across multiple Availability Zones.

Exam trap

The trap here is that candidates often confuse service discovery with load balancing or assume that a private hosted zone alone provides encryption, when in fact DNS-based discovery (Route 53) only resolves names and requires a separate mechanism like App Mesh or mTLS to encrypt traffic in transit.

How to eliminate wrong answers

Option B is wrong because using an Application Load Balancer for each service introduces unnecessary complexity and cost, and ALBs operate at the application layer (HTTP/HTTPS), which does not provide encryption for all inter-service traffic (e.g., gRPC or TCP-based services) and does not natively provide service discovery by name without additional DNS integration. Option C is wrong because VPC peering connects entire VPCs, not individual services, and does not provide service discovery or encryption; it only enables network-layer connectivity between VPCs. Option D is wrong because Amazon Route 53 private hosted zones can provide DNS-based service discovery, but they do not encrypt traffic; encryption at the application layer must be implemented separately by the application code, which violates the requirement for transparent encryption in transit.

Practice this question →
292
MCQmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is behind a NAT Gateway in the public subnet. The download is failing. Which configuration should the network engineer check FIRST?

A.The network ACL for the private subnet allows inbound HTTP/HTTPS traffic.
B.The EC2 instance has a public IP address assigned.
C.The Internet Gateway is attached to the private subnet.
D.The route table associated with the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway.
AnswerD

Correct: Without this route, traffic cannot reach the NAT Gateway.

Why this answer

For an EC2 instance in a private subnet to reach the internet via a NAT Gateway, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. Without this route, traffic from the instance destined for the internet has no path to the NAT Gateway, causing the download to fail.

Exam trap

AWS often tests the misconception that a private instance needs a public IP or that NACLs are the primary cause of outbound internet failures, when in fact the missing default route to the NAT Gateway is the most common misconfiguration.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and must allow both inbound and outbound traffic; however, the default NACL already allows all traffic, and the failure is more likely due to routing, not ACLs. Option B is wrong because an EC2 instance in a private subnet does not need a public IP address to access the internet through a NAT Gateway; the NAT Gateway itself uses an Elastic IP, and the instance uses the NAT's public IP for outbound traffic. Option C is wrong because an Internet Gateway is attached to the VPC, not to a subnet, and it is used by public subnets; private subnets route through the NAT Gateway, not directly through the Internet Gateway.

Practice this question →
293
MCQhard

A company runs a multi-tier web application on AWS. The web servers in public subnets need to send traffic to the application servers in private subnets. The application servers must only accept traffic from the web servers. Both tiers are in the same VPC. Which design meets these requirements without introducing a single point of failure or unnecessary complexity?

A.Place the web servers in a public subnet with a security group that allows inbound from 0.0.0.0/0 on port 443. Place the app servers in a private subnet with a security group that allows inbound from the web server security group on the application port.
B.Place the web servers and app servers in the same private subnet behind an internal Network Load Balancer. Route web traffic through the NLB.
C.Place the web servers in a public subnet with an Internet Gateway. Place the app servers in a private subnet with a NAT Gateway for outbound traffic. Use NACLs to allow inbound from the web subnet CIDR.
D.Place the web servers in a public subnet with a NACL allowing inbound on port 443. Place the app servers in a private subnet with a NACL allowing inbound from the web subnet CIDR on the application port.
AnswerA

This is correct because it uses security group references for fine-grained, stateful filtering without introducing a single point of failure.

Why this answer

It uses security group referencing, which allows the app servers' security group to dynamically allow traffic from any instance associated with the web servers' security group, regardless of IP address changes. This design avoids a single point of failure by not introducing any load balancer or gateway, and it minimizes complexity by leveraging native VPC security group behavior within the same VPC.

Exam trap

The trap here is that candidates often overcomplicate the solution by introducing load balancers or NAT gateways, or they incorrectly choose NACLs over security groups, not realizing that security group referencing provides a simpler, more dynamic, and more secure solution without single points of failure.

How to eliminate wrong answers

Option B is wrong because placing both tiers in the same private subnet behind an internal Network Load Balancer introduces a single point of failure (the NLB) and unnecessary complexity, as the requirement can be met with simple security group rules without a load balancer. Option C is wrong because using a NAT Gateway for outbound traffic is irrelevant to the requirement of allowing inbound traffic from web servers to app servers; it also introduces a single point of failure and unnecessary complexity. Option D is wrong because using NACLs to allow inbound from the web subnet CIDR is less secure and less dynamic than security group referencing, and NACLs are stateless, requiring separate rules for return traffic, which adds complexity and potential misconfiguration.

Practice this question →
294
Multi-Selecthard

A company has multiple VPCs connected via a Transit Gateway. They want to implement network segmentation so that only specific VPCs can communicate with each other. Which TWO methods can achieve this? (Choose two.)

Select 2 answers
A.Deploy AWS Network Firewall in a centralized inspection VPC
B.Use Transit Gateway route tables with specific associations and propagations
C.Assign instances to different security groups
D.Configure network ACLs on each subnet
E.Create separate VPC peering connections
AnswersA, B

Network Firewall can filter traffic between VPCs.

Why this answer

AWS Network Firewall can be deployed in a centralized inspection VPC to filter traffic between VPCs attached to a Transit Gateway. By routing inter-VPC traffic through the firewall appliance, you can enforce stateful inspection and allow or deny traffic based on source/destination VPCs, achieving network segmentation.

Exam trap

AWS often tests the misconception that security groups or network ACLs can control inter-VPC traffic across a Transit Gateway, but these constructs are limited to within a single VPC and do not affect transit routing.

Practice this question →
295
MCQmedium

A media company is designing a network for a new AWS environment. They have a VPC with public and private subnets in three Availability Zones. In the private subnets, they run a fleet of Amazon EC2 instances that process video files from an Amazon S3 bucket. The S3 bucket is in the same region. The company wants to ensure that all traffic to S3 stays within the AWS network and does not traverse the internet. They also need to allow the EC2 instances to access the internet for software updates, but only through a centralized NAT gateway. Currently, there is one NAT gateway in AZ1. The network engineer has created a VPC endpoint for S3 (Gateway type) and associated it with the route tables for the private subnets. However, the EC2 instances in AZ2 and AZ3 cannot reach the NAT gateway for internet access. What is the most likely cause?

A.The route table for private subnets now has a more specific route for S3 that overrides the default route to the NAT gateway
B.The VPC endpoint needs to be created in each Availability Zone
C.The NAT gateway is only available in the AZ where it is deployed
D.The S3 VPC endpoint is only accessible from the AZ where it was created
AnswerC

NAT gateway is deployed in a specific AZ but can be used by instances in other AZs if the route table directs traffic to it.

Why this answer

The most likely cause is that the NAT gateway is only available in the AZ where it is deployed because the private subnets in AZ2 and AZ3 likely do not have a default route pointing to the NAT gateway. A NAT gateway is created in a specific AZ, and while it can be accessed from other AZs using cross-AZ routing, the route tables for those subnets must be explicitly configured with a 0.0.0.0/0 route to the NAT gateway. The S3 Gateway Endpoint adds a specific route for S3 traffic, which does not override the default route; therefore, adding the endpoint does not affect internet access.

Option A is incorrect because the endpoint route is more specific for S3, not a default route. Options B and D are false because Gateway Endpoints are regional and do not require per-AZ creation, and NAT gateways can be used cross-AZ with proper routing.

Practice this question →
296
MCQhard

A company uses AWS Direct Connect with a private VIF and a virtual private gateway (VGW) to connect its on-premises data center to a VPC. The on-premises network uses BGP to advertise routes to AWS. The VPC has multiple subnets. The company wants to ensure that only traffic destined for the VPC CIDR (10.0.0.0/16) is sent over Direct Connect, and all other traffic uses the internet. However, after configuration, on-premises users can access the internet through the Direct Connect link, which is unintended. What change should be made to restrict traffic?

A.Add a static route in the VPC route table to send all traffic to the internet gateway.
B.Disable route propagation for the private subnet route table.
C.Configure the on-premises router to only accept the VPC CIDR route from AWS and not a default route.
D.Remove the virtual private gateway and use a VPN connection instead.
AnswerC

This prevents the on-premises network from using Direct Connect for internet traffic.

Why this answer

The issue arises because AWS is advertising a default route (0.0.0.0/0) to the on-premises router over BGP via Direct Connect, causing on-premises users to use Direct Connect for internet traffic. To restrict traffic, the on-premises router should be configured to accept only the VPC CIDR (10.0.0.0/16) from AWS and reject any default route. Option C is correct.

Option A is incorrect because adding a static route in the VPC route table does not affect BGP advertisements to on-premises. Option B is incorrect because disabling route propagation affects VPC subnet routing, not the BGP session. Option D is incorrect because removing the virtual private gateway would disconnect the VPC, not solve the issue.

Practice this question →
297
MCQmedium

A company is deploying a multi-tier web application across two AWS Regions with an active-passive failover architecture. The application uses Application Load Balancers (ALBs) in each Region, and traffic must be directed to the active Region using DNS. Which routing policy should be used for the Amazon Route 53 record set to achieve this?

A.Geolocation routing policy
B.Failover routing policy
C.Weighted routing policy
D.Latency routing policy
AnswerB

Failover routing policy is designed for active-passive failover configurations.

Why this answer

The failover routing policy in Amazon Route 53 is designed specifically for active-passive failover architectures. It uses health checks to monitor the primary endpoint (active Region) and automatically routes traffic to the secondary endpoint (passive Region) only when the primary health check fails. This matches the requirement of directing traffic to the active Region using DNS.

Exam trap

The trap here is that candidates often confuse failover routing with latency or weighted routing, assuming that automatic failover can be achieved by simply distributing traffic, but only failover routing policy provides the health-check-driven active-passive behavior required for this architecture.

How to eliminate wrong answers

Option A is wrong because geolocation routing policy routes traffic based on the geographic location of the user, not on the health or availability of endpoints, and it does not provide automatic failover between regions. Option C is wrong because weighted routing policy distributes traffic across multiple endpoints based on assigned weights, but it does not automatically failover to a passive region when the active region becomes unhealthy; it continues sending traffic proportionally regardless of health. Option D is wrong because latency routing policy routes traffic to the region with the lowest latency for the user, which does not guarantee that traffic goes to the designated active region and does not support active-passive failover based on health checks.

Practice this question →
298
MCQmedium

A company is deploying an application that requires low-latency communication between EC2 instances in two different AWS Regions. The application traffic is latency-sensitive and the company wants to minimize jitter. Which network design provides the lowest and most consistent latency?

A.Create a VPC peering connection between the two VPCs and route traffic through the peering connection.
B.Use internet gateways and route traffic over the public internet between the instances.
C.Use a Site-to-Site VPN connection between the two VPCs over the internet.
D.Deploy an AWS Global Accelerator with endpoints in both Regions and use the accelerator's static IP addresses for communication.
AnswerD

Global Accelerator uses the AWS global network to route traffic over optimized paths, reducing latency and jitter.

Why this answer

AWS Global Accelerator uses the AWS global network and Anycast static IP addresses to route traffic over optimized paths, providing lower and more consistent latency than VPC peering, internet transit, or VPNs. It minimizes jitter by avoiding the public internet and leveraging AWS's internal backbone, which is ideal for latency-sensitive inter-Region communication.

Exam trap

The trap here is that candidates assume VPC peering (Option A) is the best for inter-Region traffic because it's private, but they overlook that Global Accelerator provides superior latency consistency by using anycast and AWS's optimized backbone, while VPC peering still routes through the AWS global network without traffic engineering for jitter reduction.

How to eliminate wrong answers

Option A is wrong because VPC peering does not support inter-Region traffic with low jitter; it relies on the AWS global network but lacks the traffic engineering and endpoint optimization of Global Accelerator, and it does not provide static anycast IPs for consistent routing. Option B is wrong because routing over the public internet introduces variable latency and jitter due to ISP hops, congestion, and BGP path fluctuations, making it unsuitable for latency-sensitive applications. Option C is wrong because a Site-to-Site VPN over the internet adds encryption overhead and traverses the public internet, increasing latency and jitter compared to AWS's private network path.

Practice this question →
299
MCQhard

A company is designing a network for a real-time gaming application that requires extremely low latency between players. The application will be deployed on EC2 instances in multiple AWS regions. Which AWS service provides the best latency performance by using the AWS global network and anycast IPs?

A.AWS Direct Connect
B.AWS Global Accelerator
C.Amazon CloudFront
D.Amazon Route 53 Latency Routing
AnswerB

Uses anycast IPs and AWS global network for low latency.

Why this answer

AWS Global Accelerator uses the AWS global network and anycast IPs to route traffic to the optimal edge location, then over the AWS backbone to the nearest healthy endpoint. This minimizes internet hops and latency, making it ideal for real-time gaming applications that require consistent low latency across multiple regions.

Exam trap

The trap here is that candidates often confuse CloudFront's edge caching with Global Accelerator's network path optimization, but CloudFront does not use anycast IPs for dynamic traffic routing and cannot provide the same low-latency performance for real-time applications that require direct connections to backend servers.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect provides a dedicated private connection from on-premises to AWS, but it does not use anycast IPs or optimize routing between multiple AWS regions for end-user traffic; it is designed for hybrid connectivity, not global latency optimization. Option C is wrong because Amazon CloudFront is a content delivery network (CDN) that caches static and dynamic content at edge locations, but it does not use anycast IPs for TCP/UDP traffic optimization and is not designed to reduce latency for real-time gaming traffic that requires dynamic routing to the nearest application endpoint. Option D is wrong because Amazon Route 53 Latency Routing directs DNS queries to the region with the lowest latency, but it operates at the DNS level and does not use anycast IPs; it cannot provide sub-second failover or optimize the network path after the initial connection, and DNS caching can cause stale routing decisions.

Practice this question →
300
MCQhard

A company is designing a hybrid network using AWS Direct Connect with multiple VPCs in the same region. They need to ensure that traffic between on-premises and VPCs is encrypted and that VPC-to-VPC traffic does not traverse the internet. Which solution meets these requirements?

A.Use a single Direct Connect connection with multiple virtual interfaces and enable encryption on the physical connection.
B.Use AWS Transit Gateway with an IPsec VPN over Direct Connect using a virtual private gateway on each VPC, and configure Transit Gateway route tables.
C.Use AWS Transit Gateway with Direct Connect Gateway and enable encryption on the Transit Gateway attachments.
D.Set up a VPN connection over the internet between on-premises and each VPC, and use VPC Peering for VPC-to-VPC traffic.
AnswerB

Correct: IPsec provides encryption; Transit Gateway enables VPC-to-VPC.

Why this answer

It uses AWS Transit Gateway to centrally route traffic between on-premises and multiple VPCs, and an IPsec VPN over Direct Connect provides encryption for traffic between on-premises and VPCs. The Transit Gateway route tables ensure VPC-to-VPC traffic stays within the AWS network without traversing the internet, meeting both requirements.

Exam trap

The trap here is that candidates often assume Direct Connect provides encryption by default or that Transit Gateway attachments can be encrypted natively, but neither is true—encryption requires an overlay like IPsec VPN.

How to eliminate wrong answers

Option A is wrong because a single Direct Connect connection with multiple virtual interfaces does not inherently encrypt traffic; encryption must be applied at the application or IPsec layer, and the physical connection alone does not provide encryption. Option C is wrong because Direct Connect Gateway attachments do not natively support encryption; Transit Gateway attachments over Direct Connect are not encrypted unless an IPsec VPN is overlaid, and enabling encryption on attachments is not a supported feature. Option D is wrong because using a VPN over the internet for on-premises connectivity violates the requirement to avoid internet transit, and VPC Peering does not provide centralized routing or encryption for VPC-to-VPC traffic, though it avoids the internet.

Practice this question →
← PreviousPage 4 of 7 · 482 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Network Design questions.

Start 20-question session