CCNA Network Design Questions — Page 5 of 7

301

MCQhard

A media company is designing a global streaming platform using AWS. They have a primary workload in us-east-1 (VPC A, 10.0.0.0/16) and a secondary workload in eu-west-1 (VPC B, 10.1.0.0/16). They need to replicate data between these VPCs with low latency and high throughput, and also allow their on-premises data center (10.2.0.0/16) in us-east-2 to communicate with both VPCs. The on-premises network is connected to AWS via two Direct Connect connections terminating in us-east-1 and eu-west-1. The company uses a Transit Gateway in each region, with inter-region peering between the Transit Gateways. The on-premises network has BGP advertisements for 10.2.0.0/16. The routing is set up such that the on-premises network can reach both VPCs via the Direct Connect connections. However, the VPCs cannot reach each other's CIDRs. The network engineer checks the Transit Gateway route tables and sees that the inter-region peering attachment is associated with the appropriate route tables, and static routes for the remote VPC CIDRs are present. What is the MOST likely cause of the problem?

A.The inter-region peering attachment is not in the same route table as the VPC attachments

B.The VPC CIDRs overlap with each other

C.The static routes for the remote VPC CIDRs are pointing to the Direct Connect attachment instead of the inter-region peering attachment

D.The on-premises network is advertising a default route that is being preferred

AnswerC

This would cause traffic to be sent to on-premises, which cannot route between regions, causing blackhole.

Why this answer

In a Transit Gateway inter-region peering, you need to add static routes in both directions to point to the peering attachment. The engineer confirmed static routes are present, so that might not be the issue. However, a common misconfiguration is that the on-premises network's route propagation via Direct Connect may be causing the Transit Gateway to prefer the on-premises path (which may not have connectivity between regions) over the inter-region peering.

But the VPCs cannot reach each other's CIDRs, so the issue is likely that the route tables for the VPC attachments do not have the routes for the remote VPC CIDRs pointing to the inter-region peering attachment. Alternatively, the inter-region peering attachment might not be in the correct route table. The most likely issue is that the Transit Gateway route tables for the VPCs do not include routes for the remote VPC CIDRs via the peering attachment.

Since the engineer says they are present, the issue might be that the propagation from the Direct Connect attachment is overriding the static route with a less preferred route or causing a conflict. Actually, the most common problem is that the static routes for the inter-region CIDRs are pointing to the wrong attachment (e.g., the Direct Connect attachment instead of the peering attachment).

Practice this question →

302

MCQmedium

A company wants to monitor network traffic between two VPCs that are peered. Which AWS feature can capture IP traffic information for analysis?

A.AWS X-Ray

B.AWS Config

C.VPC Flow Logs

D.AWS CloudTrail

AnswerC

Network traffic logs.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including traffic between peered VPCs. They log metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions, which can be published to CloudWatch Logs or Amazon S3 for analysis. This makes them the correct choice for monitoring network traffic between two peered VPCs.

Exam trap

The trap here is that candidates confuse AWS CloudTrail (which logs API calls) with VPC Flow Logs (which logs network traffic), leading them to select CloudTrail when the question specifically asks about IP traffic information for analysis.

How to eliminate wrong answers

Option A is wrong because AWS X-Ray is designed for tracing application requests and debugging distributed applications, not for capturing IP-level network traffic metadata. Option B is wrong because AWS Config is a resource inventory and compliance service that tracks configuration changes to AWS resources, not network packet or flow data. Option D is wrong because AWS CloudTrail records API calls and management events for governance and auditing, not the IP traffic flowing across network interfaces or VPC peering connections.

Practice this question →

303

Multi-Selectmedium

A company is designing a hybrid network using AWS Direct Connect and VPN backup. The company wants to ensure that traffic always uses Direct Connect when it is available. Which TWO configurations should be implemented? (Choose TWO.)

Select 2 answers

A.Use AS_PATH prepending on the VPN BGP session to make the VPN path less preferred.

B.Advertise more specific prefixes over Direct Connect and less specific prefixes over VPN.

C.Disable BGP on the VPN connection to force traffic to Direct Connect.

D.Set a lower MED value on the Direct Connect BGP session.

E.Advertise the same prefixes over both connections with the same AS_PATH length.

AnswersA, B

Longer AS_PATH is less preferred.

Why this answer

AS_PATH prepending on the VPN BGP session increases the AS_PATH length for routes advertised over the VPN, making them less preferred compared to the same routes learned over Direct Connect with a shorter AS_PATH. BGP selects the path with the shortest AS_PATH length, so traffic will use Direct Connect when it is available. This is a standard technique for influencing outbound traffic path selection in a hybrid network.

Exam trap

AWS often tests the distinction between outbound and inbound traffic manipulation; the trap here is that candidates may incorrectly apply MED (which influences inbound traffic) or think disabling BGP is acceptable, when the correct approach for outbound traffic preference is to manipulate AS_PATH length or local preference.

Practice this question →

304

MCQhard

A large e-commerce company operates a multi-tier application across multiple AWS accounts. The web tier is in a VPC (10.0.0.0/16) in Account A, and the application tier is in a separate VPC (10.1.0.0/16) in Account B. Both VPCs are connected via a VPC peering connection. The application tier uses an NLB to distribute traffic to EC2 instances in private subnets. The web tier sends traffic to the NLB's private IP address. Recently, the company migrated the application tier to use AWS PrivateLink instead of the VPC peering connection, creating a VPC endpoint service in Account B and an interface VPC endpoint in Account A. After the migration, the web tier cannot connect to the application tier. The security groups and NACLs allow the traffic. Which of the following is the MOST likely cause of the connectivity issue?

A.The web tier instances are using the private IP address of the Network Load Balancer instead of the VPC endpoint DNS name or private IP addresses.

B.The route tables in Account A's VPC do not have a route to the VPC endpoint service in Account B.

C.The VPC endpoint in Account A requires an Internet Gateway (IGW) to route traffic to the VPC endpoint service in Account B.

D.The Network Load Balancer in Account B is not configured to support TCP traffic.

AnswerA

Correct; after migrating to PrivateLink, the web tier should use the VPC endpoint's DNS name or its assigned private IPs, not the NLB's IP directly.

Why this answer

After migrating from VPC peering to AWS PrivateLink, the web tier instances must use the VPC endpoint's DNS name or its private IP addresses to connect to the application tier. The VPC endpoint provides a different set of IP addresses (from the subnet in Account A) than the NLB's private IP, which remains in Account B. Since the web tier continues to send traffic to the NLB's private IP, the packets are not routed through the VPC endpoint, causing connectivity failure because the VPC peering connection is no longer available.

Exam trap

The trap here is that candidates assume PrivateLink transparently forwards traffic to the original NLB IP, but in reality the consumer must use the endpoint's DNS name or IP, not the service's original IP.

How to eliminate wrong answers

Option B is wrong because VPC endpoints do not require route table entries; traffic to the endpoint service is routed via the endpoint's elastic network interface in the subnet, not through route tables. Option C is wrong because interface VPC endpoints do not require an Internet Gateway; they use private IP addresses within the VPC and communicate over the AWS network without internet access. Option D is wrong because Network Load Balancers support TCP traffic by default; the issue is not about protocol support but about the destination IP address used by the web tier.

Practice this question →

305

MCQmedium

A company has a VPC with public and private subnets in three Availability Zones. An internet-facing Network Load Balancer (NLB) is deployed in the public subnets, and a fleet of EC2 instances is in the private subnets. The application logs show intermittent connection timeouts. The security group for the EC2 instances allows traffic from the NLB's security group. What is the MOST likely cause?

A.Cross-zone load balancing is disabled on the NLB.

B.The EC2 instances' security group allows traffic from the NLB's security group, but the NLB preserves client IP, so the security group must allow client IPs directly.

C.The NLB's security group is not allowing traffic from the EC2 instances.

D.The network ACLs in the private subnets are blocking return traffic.

AnswerB

NLB preserves source IP; security group references to NLB's security group only work for traffic that originates from NLB's private IPs, but NLB sends client IPs.

Why this answer

When an NLB is configured with `preserve_client_ip` enabled (the default for internet-facing NLBs), the source IP of incoming packets is the actual client IP, not the NLB's private IP. Therefore, the EC2 instances' security group must allow traffic from the client IPs, not from the NLB's security group. Since the security group only allows traffic from the NLB's security group, packets from client IPs are dropped, causing intermittent connection timeouts.

Exam trap

The ANS-C01 exam often tests the misconception that an NLB's security group can be used as a source in backend instance security groups, similar to an ALB, but the NLB's preserve_client_ip feature breaks that assumption.

How to eliminate wrong answers

Option A is wrong because cross-zone load balancing affects traffic distribution across AZs, not security filtering; disabling it would cause uneven load but not connection timeouts due to security group rules. Option C is wrong because the NLB's security group controls inbound traffic to the NLB, not outbound return traffic from EC2 instances; the issue is with the EC2 security group inbound rules. Option D is wrong because network ACLs are stateless and must allow both inbound and outbound traffic; if they were blocking return traffic, the timeouts would be consistent, not intermittent, and the question states the security group is the configured filter.

Practice this question →

306

MCQhard

A company has a Direct Connect connection with a private VIF attached to a Direct Connect Gateway. The company wants to connect to multiple VPCs in the same AWS Region. What is the MOST cost-effective and scalable design?

A.Provision multiple private VIFs, each connected to a different VPC.

B.Create a Direct Connect Gateway and associate each VPC's Virtual Private Gateway to it using a private VIF.

C.Create a Transit Gateway, attach it to the Direct Connect Gateway using a Transit VIF, and attach each VPC to the Transit Gateway.

D.Use a private VIF to connect to a Virtual Private Gateway in one VPC and use VPC Peering to reach other VPCs.

AnswerC

This is scalable and cost-effective.

Why this answer

It uses a Transit Gateway (TGW) to interconnect multiple VPCs and a Direct Connect Gateway (DXGW) via a Transit VIF, which is the most cost-effective and scalable design. The Transit VIF allows a single Direct Connect connection to be shared across many VPCs through the TGW, avoiding the need for multiple private VIFs or complex peering arrangements. This design scales to hundreds of VPCs and reduces operational overhead by centralizing routing.

Exam trap

AWS often tests the misconception that a Direct Connect Gateway alone can provide transitive routing between VPCs, but in reality, a Direct Connect Gateway only connects VPCs to on-premises networks, not VPCs to each other, which is why a Transit Gateway is needed for inter-VPC connectivity.

How to eliminate wrong answers

Option A is wrong because provisioning multiple private VIFs for each VPC is not cost-effective (each VIF incurs separate port and data transfer charges) and does not scale well beyond a few VPCs. Option B is wrong because a Direct Connect Gateway can associate multiple Virtual Private Gateways (VGWs) via a single private VIF, but this design requires each VPC to have its own VGW and does not provide transitive routing between VPCs; it only connects each VPC to the on-premises network, not to each other. Option D is wrong because using VPC Peering to connect other VPCs creates a non-transitive, point-to-point mesh that does not scale (each peering connection is a separate relationship) and introduces complex routing and bandwidth limitations, while still relying on a single VPC as a hub.

Practice this question →

307

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16. They need to peer with another VPC that has a CIDR of 10.0.0.0/24. What will happen?

A.The peering connection will be established, but only the first VPC's CIDR will be used.

B.The peering connection will be established, but routes with overlapping CIDRs will not be added automatically.

C.The peering connection will fail because the CIDRs overlap.

D.The peering connection will be established, and the overlapping CIDRs will be ignored.

AnswerC

VPC Peering requires non-overlapping IP address ranges.

Why this answer

AWS VPC peering requires that the CIDR blocks of the two VPCs do not overlap. When both VPCs use the same IP range (10.0.0.0/16 and 10.0.0.0/24), the peering connection request will fail because overlapping CIDRs create routing ambiguity and are not supported by the VPC peering service. This is a hard limit enforced at the time of peering creation, not during route table configuration.

Exam trap

The ANS-C01 exam often tests the misconception that overlapping CIDRs are allowed in VPC peering but simply cause routing issues later, when in fact the peering creation itself is blocked by the AWS API.

How to eliminate wrong answers

Option A is wrong because the peering connection will not be established at all; AWS does not allow overlapping CIDRs to proceed with peering, so no CIDR is 'used'. Option B is wrong because the peering connection fails before any route tables are modified; automatic route propagation never occurs for overlapping CIDRs. Option D is wrong because overlapping CIDRs are not ignored; the peering request is rejected outright by the AWS API with an error indicating the conflict.

Practice this question →

308

MCQmedium

A company has a VPC with public and private subnets in two Availability Zones. An Application Load Balancer in the public subnets distributes traffic to EC2 instances in the private subnets. The security group for the EC2 instances allows inbound traffic from the ALB security group. Users report intermittent timeouts. What is the most likely cause?

A.The security group for the ALB does not allow inbound traffic from the internet.

B.The ALB is not associated with an internet gateway.

C.The network ACL for the private subnets is blocking inbound traffic from the ALB subnets.

D.Cross-zone load balancing is disabled on the ALB.

AnswerC

Correct. Network ACLs are stateless and must allow both inbound and outbound ephemeral port traffic. A missing inbound rule for ephemeral ports from ALB subnets will cause intermittent timeouts as some connections succeed and others fail.

Why this answer

Intermittent timeouts are often caused by network ACL rules that block ephemeral ports used for return traffic. The ALB initiates connections to EC2 instances on random ephemeral ports (1024-65535). If the private subnet's network ACL denies inbound traffic on these ports from the ALB subnets, connections will fail intermittently.

In contrast, a missing inbound rule on the ALB security group would result in consistent failures, not intermittent ones.

Exam trap

Candidates often overlook that network ACLs are stateless and must allow ephemeral ports for return traffic. A missing rule for high ports (1024-65535) causes intermittent failures, not a complete outage.

How to eliminate wrong answers

Option B is wrong because an ALB in a public subnet is automatically associated with an internet gateway via the subnet's route table; no explicit association is required. Option C is wrong because network ACLs are stateless and, by default, allow all inbound and outbound traffic; even if modified, the ALB's traffic originates from its own subnets, and the private subnet's NACL would need to explicitly deny traffic from the ALB subnet CIDR, which is unlikely to cause intermittent timeouts. Option D is wrong because cross-zone load balancing is enabled by default on ALBs, and disabling it would cause uneven traffic distribution but not intermittent timeouts; all targets would still be reachable within their own zone.

Practice this question →

309

MCQeasy

A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is internet-facing and receives traffic from clients. The company wants to improve security by adding an additional layer of protection against common web exploits like SQL injection and cross-site scripting. Which AWS service should they use?

A.AWS Firewall Manager

B.AWS WAF

C.AWS Shield Advanced

D.Network ACLs

AnswerB

Web application firewall that filters SQL injection and XSS.

Why this answer

AWS WAF (Web Application Firewall) is the correct service because it is specifically designed to protect web applications from common exploits such as SQL injection and cross-site scripting (XSS). It integrates directly with an Application Load Balancer (ALB) to inspect HTTP/HTTPS requests and apply customizable rules to block malicious traffic before it reaches the EC2 instances.

Exam trap

The trap here is that candidates often confuse AWS WAF with AWS Shield Advanced, mistakenly thinking Shield Advanced covers application-layer exploits, when in fact Shield Advanced focuses on volumetric DDoS protection and WAF handles Layer 7 threats like SQL injection and XSS.

How to eliminate wrong answers

Option A is wrong because AWS Firewall Manager is a centralized policy management service that helps manage AWS WAF, AWS Shield Advanced, and VPC security groups across accounts, but it does not itself inspect web traffic or block application-layer attacks. Option C is wrong because AWS Shield Advanced provides protection against Distributed Denial of Service (DDoS) attacks at the network and transport layers, not against application-layer exploits like SQL injection or XSS. Option D is wrong because Network ACLs are stateless packet filters that operate at the subnet level (Layer 3/4) and cannot inspect application-layer payloads or block specific HTTP request patterns.

Practice this question →

310

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16 and uses AWS Direct Connect with a private VIF to connect to on-premises. The on-premises network uses 10.0.0.0/8. The company wants to access an AWS service (e.g., S3) privately from the VPC without using public endpoints. Which solution avoids IP overlap and meets the requirement?

A.Create a NAT gateway in a public subnet and route S3 traffic through it.

B.Create a VPC endpoint for S3 (Gateway type) and use it from the VPC.

C.Use a public virtual interface and access S3 via public endpoints.

D.Add a route in the VPC route table pointing to the Direct Connect virtual interface for the S3 prefix list.

AnswerB

VPC endpoint provides private access without overlapping IPs.

Why this answer

A Gateway VPC Endpoint for S3 allows private access to S3 from within the VPC without traversing the internet or requiring public IPs. It avoids IP overlap because the endpoint uses prefix lists and route table entries within the VPC's 10.0.0.0/16 range, and does not involve the on-premises 10.0.0.0/8 network. The Direct Connect private VIF is not used for S3 traffic, so the overlapping CIDR is irrelevant.

Exam trap

The trap here is that candidates assume a private VIF can be used to reach AWS services privately, but they overlook the IP overlap between the VPC and on-premises networks, which breaks routing and makes Gateway VPC Endpoints the only viable solution.

How to eliminate wrong answers

Option A is wrong because a NAT gateway requires a public subnet and routes traffic through the internet, which does not meet the requirement of private access without public endpoints. Option C is wrong because a public virtual interface accesses S3 via public endpoints over the internet, violating the private access requirement. Option D is wrong because adding a route to the Direct Connect private VIF for the S3 prefix list would attempt to route S3 traffic over the private VIF, but the on-premises network uses 10.0.0.0/8, which overlaps with the VPC's 10.0.0.0/16, causing routing conflicts and preventing proper connectivity.

Practice this question →

311

MCQmedium

A company is deploying a critical application across multiple Availability Zones (AZs) in a single AWS region. The application requires a highly available network layer that can automatically detect and reroute traffic away from failed endpoints. Which AWS service should be used to meet this requirement?

A.Network Load Balancer (NLB)

B.AWS Global Accelerator

C.Application Load Balancer (ALB)

D.NAT gateway

AnswerA

NLB provides high availability and automatic rerouting at Layer 4.

Why this answer

A Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) and is designed to handle millions of requests per second with extremely low latency. It performs health checks on targets (e.g., EC2 instances) in each Availability Zone and automatically reroutes traffic away from unhealthy endpoints, providing the required high availability and automatic failover across AZs.

Exam trap

The trap here is that candidates often confuse the Layer 4 NLB with the Layer 7 ALB, or mistakenly think Global Accelerator provides the same automatic failover at the network layer, when in fact Global Accelerator is a traffic optimization service that requires a separate load balancer for endpoint health checking.

How to eliminate wrong answers

Option B is wrong because AWS Global Accelerator improves performance by directing traffic to the optimal endpoint over the AWS global network, but it does not itself perform health-check-based rerouting at the network layer within a single region; it relies on an underlying load balancer or endpoint for that. Option C is wrong because the Application Load Balancer (ALB) operates at Layer 7 (HTTP/HTTPS) and is not the best choice for a purely network-layer (Layer 4) requirement; it introduces unnecessary protocol overhead and is not designed for raw TCP/UDP traffic. Option D is wrong because a NAT gateway provides outbound internet connectivity for instances in private subnets and does not perform load balancing or health-check-based traffic rerouting across endpoints.

Practice this question →

312

MCQmedium

A company has a VPC peering connection between VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Both VPCs have subnets with EC2 instances. The security groups allow all traffic between the instances. The instances in VPC A can ping the instances in VPC B, but cannot initiate TCP connections to a web server running on port 443 in VPC B. What is the most likely cause?

A.The VPC peering connection does not support TCP traffic.

B.The DNS resolution settings for the VPC peering are not enabled.

C.The security group for the web server in VPC B does not allow inbound traffic from VPC A on TCP port 443.

D.The network ACL in VPC B is blocking inbound TCP traffic on port 443.

AnswerC

Security groups are stateful; if inbound rule missing, TCP connections are denied while ICMP might be allowed.

Why this answer

The security group for the web server in VPC B must explicitly allow inbound traffic from VPC A on TCP port 443. Even though ICMP (ping) works because security groups by default allow all outbound traffic and ICMP may be permitted, TCP connections require an explicit inbound rule. Option A is incorrect because VPC peering supports TCP traffic.

Option B is incorrect because DNS resolution settings are not required for direct TCP connections over VPC peering. Option D is incorrect because network ACLs are stateless and would block both ICMP and TCP if misconfigured; since ping works, a NACL issue is unlikely.

Practice this question →

313

MCQmedium

A company has a VPC with a CIDR block of 10.0.0.0/16 and needs to connect to a partner's VPC with CIDR 10.0.0.0/16. The VPCs are in the same Region. What is the best solution?

A.Use an AWS Site-to-Site VPN connection

B.Establish VPC peering between the two VPCs

C.Use an AWS Transit Gateway with a transit gateway attachment and configure NAT on the transit gateway to translate IPs

D.Use an AWS Direct Connect private virtual interface

AnswerC

Transit Gateway can perform NAT to resolve overlapping CIDRs.

Why this answer

When two VPCs have overlapping CIDR blocks (both 10.0.0.0/16), VPC peering and Direct Connect cannot resolve the IP conflict, as they require non-overlapping address spaces. An AWS Transit Gateway with NAT attachments can translate IP addresses at the transit gateway level, allowing traffic to flow between overlapping VPCs by mapping source/destination IPs to non-conflicting ranges. This solution provides a scalable, managed way to handle overlapping CIDRs without complex manual routing.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering or VPN can handle overlapping CIDRs by simply adding routes, but the trap is that overlapping IPs cause routing ambiguity and packet loss, requiring NAT at the transit gateway or a middlebox appliance to resolve the conflict.

How to eliminate wrong answers

Option A is wrong because an AWS Site-to-Site VPN connection also requires non-overlapping CIDR blocks for proper routing; overlapping IPs would cause routing conflicts and asymmetric traffic, as VPN tunnels rely on static routes that cannot differentiate between identical subnets. Option B is wrong because VPC peering requires that the VPC CIDR blocks do not overlap; with both VPCs using 10.0.0.0/16, peering is impossible as the route tables would have duplicate entries, leading to ambiguous routing. Option D is wrong because an AWS Direct Connect private virtual interface connects on-premises networks to a VPC, not between two VPCs, and it also cannot resolve overlapping CIDR conflicts between VPCs.

Practice this question →

314

MCQhard

A company is deploying a global application with users in North America and Europe. The application runs on EC2 instances in us-east-1 and eu-west-1. To reduce latency, the company wants to route users to the nearest region and provide automatic failover. Which combination of AWS services should be used?

A.Amazon CloudFront with origins in each region.

B.AWS Global Accelerator with endpoint groups in each region.

C.Amazon Route 53 with geolocation routing and health checks.

D.Amazon Route 53 with latency-based routing and health checks.

AnswerD

Latency routing directs users to the lowest-latency region, health checks provide failover.

Why this answer

Amazon Route 53 latency-based routing directs users to the region with the lowest latency, automatically routing traffic to the nearest region. Combined with health checks, if an endpoint fails, Route 53 automatically fails over to the next lowest-latency healthy endpoint, meeting both the latency reduction and automatic failover requirements.

Exam trap

AWS often tests the distinction between geolocation routing (which uses static geographic mapping) and latency-based routing (which uses dynamic network performance data), and candidates mistakenly choose geolocation routing because they think 'nearest region' means geographic proximity rather than network latency.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations; it does not provide active-active routing or automatic failover between regional origins based on user proximity for dynamic application traffic—it primarily accelerates static and dynamic content delivery via edge caching, not regional routing with health-check-based failover. Option B is wrong because AWS Global Accelerator uses endpoint groups to route traffic to the nearest region via Anycast IPs, but it does not natively support automatic failover between endpoint groups based on health checks—failover requires manual intervention or additional automation, and Global Accelerator is designed for TCP/UDP traffic optimization, not DNS-level routing with health-check-driven failover. Option C is wrong because Amazon Route 53 geolocation routing routes traffic based on the user's geographic location, not latency; it does not automatically fail over to the next nearest region if the primary region is unhealthy—geolocation routing requires explicit failover rules (e.g., failover routing) and does not dynamically adjust to latency changes.

Practice this question →

315

MCQeasy

A company wants to ensure that traffic between Amazon EC2 instances in the same VPC but different subnets is inspected by a network security appliance. The appliance is deployed in a separate security VPC. Which AWS service should be used to route traffic through the security VPC?

A.AWS Transit Gateway

B.VPC Peering

C.VPC Endpoint

D.Network Load Balancer

AnswerA

Transit Gateway can route traffic between VPCs with route tables enabling inspection.

Why this answer

AWS Transit Gateway acts as a hub-and-spoke router that can interconnect multiple VPCs, including a security VPC, and centrally route traffic between them. By attaching both the workload VPC and the security VPC to a Transit Gateway, you can configure route tables to force all inter-subnet traffic (or inter-VPC traffic) through the network security appliance in the security VPC. This enables inspection without requiring a full mesh of VPC peering connections or complex routing.

Exam trap

The trap here is that candidates often confuse VPC Peering with transitive routing, assuming that multiple peering connections can chain traffic through a middle VPC, but AWS explicitly prohibits transitive routing through VPC peering.

How to eliminate wrong answers

Option B (VPC Peering) is wrong because VPC peering creates a direct, one-to-one connection between two VPCs and does not support transitive routing; you cannot route traffic from one VPC through a peered VPC to another VPC or subnet. Option C (VPC Endpoint) is wrong because VPC endpoints are used to privately connect to AWS services (e.g., S3, DynamoDB) via PrivateLink, not to route traffic between EC2 instances in different subnets through a security appliance. Option D (Network Load Balancer) is wrong because an NLB distributes incoming traffic to targets (e.g., EC2 instances) and does not perform routing or forwarding of traffic between subnets within a VPC; it operates at Layer 4 and cannot inspect or redirect traffic based on routing policies.

Practice this question →

316

MCQmedium

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to two on-premises locations via AWS Direct Connect. Each Direct Connect connection uses a private VIF. The company wants to use BGP to exchange routes. The on-premises routers advertise the same prefix 10.0.0.0/8 for both connections. How should the network engineer configure the VPC route tables to ensure traffic is load balanced across both Direct Connect connections?

A.Create a VPN connection over the Direct Connect and use BGP with different metrics.

B.Create two separate route tables and associate each with half the subnets.

C.Use AWS Transit Gateway with equal cost multipath routing.

D.Allow BGP to install both routes; AWS will automatically load balance across them using ECMP.

AnswerD

When identical routes are learned from two Direct Connect connections, AWS uses ECMP.

Why this answer

AWS Direct Connect private VIFs support BGP route exchange, and when two separate connections advertise the same prefix (10.0.0.0/8), BGP installs both routes in the VPC route table. AWS automatically performs Equal-Cost Multi-Path (ECMP) routing across the two Direct Connect connections, load-balancing traffic without additional configuration. This behavior is inherent to how AWS handles multiple BGP-learned routes with identical prefixes and metrics.

Exam trap

The trap here is that candidates often assume AWS requires Transit Gateway or VPN overlay to achieve load balancing, but AWS natively supports ECMP across multiple Direct Connect private VIFs attached to the same VPC, as long as the BGP-advertised prefixes are identical and the routes are installed in the same route table.

How to eliminate wrong answers

Option A is wrong because creating a VPN over Direct Connect adds unnecessary complexity and does not enable ECMP; BGP metrics (MED, AS-path) are not used by AWS to influence load balancing across separate Direct Connect connections. Option B is wrong because splitting subnets into separate route tables does not load-balance traffic across both connections; each subnet would still use a single route for the 10.0.0.0/8 prefix, failing to distribute traffic. Option C is wrong because AWS Transit Gateway does support ECMP, but it is not required for this scenario; the VPC itself can perform ECMP across two Direct Connect private VIFs without Transit Gateway, making this an over-engineered solution.

Practice this question →

317

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 10.0.0.0/8. The company wants to use AWS Site-to-Site VPN. What configuration change is required to avoid routing conflicts?

A.Create a more specific route in the VPC route table for the on-premises CIDR.

B.Enable route propagation on the VPC route tables.

C.Use a VPN connection with static routes instead of BGP.

D.Change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16.

AnswerD

Eliminates the overlap.

Why this answer

The VPC CIDR 10.0.0.0/16 is a subset of the on-premises CIDR 10.0.0.0/8. AWS Site-to-Site VPN cannot route traffic correctly when the VPC and on-premises networks have overlapping IP ranges because the VPN connection relies on distinct destination prefixes. The only way to eliminate the conflict is to change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16, ensuring no IP address overlap between the two networks.

Exam trap

The trap here is that candidates think they can override the conflict with a more specific route or by switching to static routes, but they overlook that the VPC's local route is always more specific than any VPN route for overlapping prefixes, making the conflict unresolvable without changing the VPC CIDR.

How to eliminate wrong answers

Option A is wrong because creating a more specific route (e.g., 10.0.0.0/16) in the VPC route table for the on-premises CIDR would still result in overlapping IP space; the VPC itself uses 10.0.0.0/16, so traffic destined for the on-premises 10.0.0.0/8 would be ambiguous and could be routed locally instead of over the VPN. Option B is wrong because enabling route propagation on VPC route tables only imports routes from the VPN connection (via BGP or static), but it does not resolve the fundamental IP overlap; the VPC and on-premises networks still share the same address space, causing routing conflicts. Option C is wrong because using static routes instead of BGP does not address the overlapping CIDR issue; whether routes are learned dynamically or statically, the VPC and on-premises networks cannot have overlapping IP ranges for the VPN to function correctly.

Practice this question →

318

MCQmedium

A company is designing a network for a critical application that requires low latency and high throughput between EC2 instances in the same AWS Region. Which network design should the company use?

A.Launch the instances in a Cluster Placement Group.

B.Launch the instances in a Spread Placement Group.

C.Launch the instances as larger instance types with enhanced networking.

D.Launch the instances in different Availability Zones.

AnswerA

Cluster Placement Groups provide low-latency, high-throughput networking.

Why this answer

A Cluster Placement Group is the correct choice because it provides the lowest possible latency and highest throughput between EC2 instances by placing them in a single Availability Zone with non-blocking, high-bandwidth networking. This design is ideal for tightly coupled, high-performance computing (HPC) or latency-sensitive applications that require consistent, low-latency communication within the same AWS Region.

Exam trap

The trap here is that candidates often confuse 'enhanced networking' (Option C) as a standalone solution for low latency, overlooking that placement group optimization is required to achieve the lowest possible latency and highest throughput, even with enhanced networking enabled.

How to eliminate wrong answers

Option B is wrong because a Spread Placement Group spreads instances across distinct hardware racks or Availability Zones to maximize fault tolerance, which increases network latency and reduces throughput due to physical separation, making it unsuitable for low-latency, high-throughput requirements. Option C is wrong because while larger instance types with enhanced networking (e.g., ENA, SR-IOV) improve network performance, they do not guarantee the same low-latency, non-blocking connectivity as a Cluster Placement Group, which also leverages these features but adds the critical placement optimization. Option D is wrong because launching instances in different Availability Zones introduces cross-AZ network latency and bandwidth constraints (e.g., inter-AZ data transfer costs and higher jitter), which directly contradicts the need for low latency and high throughput.

Practice this question →

319

Multi-Selectmedium

A company is designing a Direct Connect solution for high availability. Which of the following are best practices? (Select THREE.)

Select 3 answers

A.Use the same Direct Connect provider for both connections to simplify management.

B.Provision two Direct Connect connections at different locations.

C.Configure Bidirectional Forwarding Detection (BFD) on the virtual interfaces.

D.Use a single Direct Connect connection with multiple virtual interfaces.

E.Use separate BGP sessions for each connection with different AS numbers if needed.

AnswersB, C, E

Diverse locations provide physical redundancy.

Why this answer

Provisioning two Direct Connect connections at different locations ensures physical diversity, which is a fundamental requirement for high availability. If one data center or fiber path fails, the other connection can continue to carry traffic, preventing a single point of failure. This aligns with the AWS Well-Architected Framework's recommendation for redundant network paths.

Exam trap

The trap here is that candidates often confuse logical redundancy (multiple virtual interfaces on one connection) with physical redundancy (multiple connections at different locations), leading them to select Option D as a valid high-availability solution.

Practice this question →

320

MCQmedium

Refer to the exhibit. An EC2 instance in the PrivateSubnet is unable to download patches from the internet. What is the most likely cause?

A.The private subnet is not associated with any route table.

B.The NAT gateway does not support IPv6 traffic.

C.The private subnet does not have MapPublicIpOnLaunch set to true.

D.The PrivateRoute resource references the NAT gateway before it is created.

AnswerD

Missing DependsOn causes a dependency issue.

Why this answer

The PrivateRoute resource references the NAT gateway using a NatGatewayId, but the NAT gateway is defined after the route in the CloudFormation template. Without a DependsOn attribute on the route to ensure the NAT gateway is created first, the route will attempt to reference a non-existent resource, causing a creation failure. This is the most likely cause of the EC2 instance's inability to download patches.

Option A is incorrect because the private subnet is indeed associated with a route table (the PrivateRouteTable). Option B is incorrect because the issue pertains to IPv4 traffic, not IPv6; NAT gateway supports IPv4. Option C is incorrect because MapPublicIpOnLaunch is a setting for public subnets and does not affect internet access via NAT gateway.

Practice this question →

321

MCQeasy

A startup wants to design a cost-effective network for a new application. They expect low traffic initially but need to handle sudden spikes. They plan to use Amazon EC2 instances behind an Application Load Balancer (ALB) in a single VPC. The application must be highly available within the region. The network engineer has proposed using two public subnets in two Availability Zones for the ALB, and two private subnets for the EC2 instances. The EC2 instances need to access the internet for updates. What is the MOST cost-effective and highly available design?

A.Use a single NAT instance in one public subnet

B.Use a NAT gateway in each public subnet (one per AZ)

C.Use a NAT instance in each public subnet (one per AZ)

D.Use a single NAT gateway in one public subnet

AnswerB

Highly available and managed.

Why this answer

Using a NAT gateway in each Availability Zone provides high availability because each AZ has its own NAT gateway, eliminating a single point of failure. NAT gateways are managed by AWS, reducing operational overhead compared to NAT instances. Option A is wrong because a single NAT instance is a single point of failure.

Option C is wrong because while NAT instances per AZ provide high availability, they require manual management and are less cost-effective than using managed NAT gateways. Option D is wrong because a single NAT gateway is a single point of failure.

Practice this question →

322

Multi-Selecthard

A company is migrating a legacy application to AWS. The application uses multicast for service discovery. Which AWS service or feature can be used to support multicast traffic within a VPC?

Select 1 answer

A.AWS Direct Connect with multicast

B.AWS Transit Gateway with multicast domain

C.VPC multicast groups using network interfaces

D.Internet Gateway (IGW)

E.VPC Peering

AnswersB

AWS Transit Gateway multicast domains provide native support for multicast traffic within a VPC, allowing service discovery traffic to be forwarded between VPCs or on-premises networks.

Why this answer

AWS Transit Gateway multicast domains (option B) is the only service that natively supports multicast traffic within a VPC. The other listed options do not support multicast: Direct Connect requires additional on-premises configuration and does not provide VPC-native multicast, VPC multicast groups are not a supported feature, Internet Gateway only handles unicast, and VPC Peering also only supports unicast. Therefore, the correct answer is B.

Exam trap

Candidates often assume that Direct Connect or VPC Peering can support multicast because they handle general IP traffic, but AWS restricts multicast to Transit Gateway multicast domains only.

Practice this question →

323

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16. They have set up a VPC peering connection with another VPC (CIDR 172.16.0.0/16). The route tables are configured correctly. However, instances in the first VPC cannot communicate with instances in the peered VPC. The security groups and network ACLs are configured to allow all traffic. What is the most likely cause?

A.The DNS resolution settings for the VPC peering connection are not enabled.

B.The route tables in the VPCs are not propagated to the subnets.

C.The instances do not have ICMP traffic allowed.

D.The VPC CIDR ranges overlap.

AnswerA

When VPC peering is created, DNS resolution must be enabled to allow DNS hostnames to resolve across the peering connection.

Why this answer

The most likely cause is that the VPC peering connection's DNS resolution settings are not enabled. While basic IP connectivity does not require DNS, if instances are using private DNS hostnames (a common default), DNS queries for the peered VPC will fail unless this setting is enabled. Since the route tables are correctly configured, security groups allow all traffic, and CIDR ranges do not overlap, the DNS resolution setting is the only remaining plausible cause from the options.

Exam trap

The ANS-C01 exam often tests the misconception that route tables and security groups are the only requirements for VPC peering communication, while the subtle DNS resolution setting is a common overlooked prerequisite.

How to eliminate wrong answers

Option B is wrong because route tables in VPCs are not 'propagated to subnets' in the context of VPC peering; route tables are associated with subnets, and propagation is a concept for VPN or Direct Connect, not for VPC peering. Option C is wrong because the question states that security groups and network ACLs are configured to allow all traffic, and ICMP is not required for general TCP/UDP communication; the issue is not about ICMP traffic being disallowed. Option D is wrong because the VPC CIDR ranges (10.0.0.0/16 and 172.16.0.0/16) do not overlap; they are from different private IP address ranges, so overlapping CIDRs is not the cause.

Practice this question →

324

MCQmedium

A company is designing a VPC with multiple subnets across three Availability Zones. The application requires that all traffic between subnets within the same AZ stay within that AZ to minimize latency and data transfer costs. Which configuration achieves this?

A.Use a single route table for all subnets and add specific routes for each AZ.

B.Use an AWS Transit Gateway with separate attachments for each AZ.

C.Create a VPC peering connection between subnets in the same AZ.

D.Create a route table for each AZ and associate the subnets in that AZ with the route table. Ensure the route tables have only local routes for the VPC CIDR.

AnswerD

Local routing within the same AZ is used.

Why this answer

Each Availability Zone (AZ) has its own route table with only the local VPC CIDR route. This ensures that traffic between subnets in the same AZ uses the VPC's local routing, which stays within the AZ's physical infrastructure, minimizing latency and avoiding cross-AZ data transfer costs. AWS VPC local routes inherently keep traffic within the same AZ when source and destination are in the same AZ, as the underlying network fabric directs traffic locally without traversing AZ boundaries.

Exam trap

The ANS-C01 exam often tests the misconception that a single route table or a centralized service like Transit Gateway can achieve AZ-level traffic isolation, but the key is that local VPC routing inherently stays within the AZ only when the route table is per-AZ and contains only the local VPC CIDR, not when a shared route table or additional network appliances are introduced.

How to eliminate wrong answers

Option A is wrong because using a single route table for all subnets does not isolate traffic per AZ; all subnets share the same routing table, and local routes for the VPC CIDR would still allow cross-AZ traffic, which does not guarantee that traffic stays within the same AZ. Option B is wrong because AWS Transit Gateway attachments are regional and do not provide per-AZ isolation; traffic between subnets in the same AZ would still traverse the Transit Gateway, which is a centralized appliance that introduces additional latency and cross-AZ data transfer costs if attachments span AZs. Option C is wrong because VPC peering connections are between VPCs, not between subnets within the same VPC; subnets in the same VPC already communicate via the VPC's local router, and creating a VPC peering connection between subnets is not possible and would be redundant, adding unnecessary complexity without any benefit for intra-VPC traffic.

Practice this question →

325

MCQhard

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company wants to use a single NAT Gateway for all private subnets to reduce costs, but the NAT Gateway is in a single Availability Zone (AZ). The network architect is concerned about single points of failure. Which design best addresses high availability while still using the minimum number of NAT Gateways?

A.Deploy a single NAT Gateway in one AZ and use a VPN to an on-premises internet gateway as backup.

B.Deploy one NAT Gateway in each AZ that contains private subnets, and update the route tables accordingly.

C.Use a NAT instance in an Auto Scaling group across multiple AZs instead of a NAT Gateway.

D.Create a second VPC with a NAT Gateway and peer the VPCs to share the NAT Gateway.

AnswerB

This ensures each AZ is independent; if one NAT Gateway fails, only that AZ loses internet access.

Why this answer

Deploying one NAT Gateway per Availability Zone (AZ) that contains private subnets ensures that if an AZ fails, the private subnets in other AZs still have internet access via their local NAT Gateway. This design provides high availability while using the minimum number of NAT Gateways necessary to cover all AZs with private subnets, avoiding a single point of failure without over-provisioning.

Exam trap

The trap here is that candidates assume a single NAT Gateway is sufficient for high availability if placed in a multi-AZ setup, but they overlook that NAT Gateway is an AZ-scoped resource and does not automatically fail over to another AZ, so a single NAT Gateway remains a single point of failure.

How to eliminate wrong answers

Option A is wrong because a VPN to an on-premises internet gateway does not provide automatic failover for NAT Gateway traffic; it requires complex routing and does not offer the same level of availability or performance as a second NAT Gateway in another AZ. Option C is wrong because a NAT instance in an Auto Scaling group across multiple AZs introduces management overhead, potential throughput limitations, and does not match the managed service benefits of NAT Gateway (e.g., automatic scaling, high bandwidth, and no maintenance). Option D is wrong because creating a second VPC and using VPC peering to share a NAT Gateway adds unnecessary complexity, latency, and cost, and does not solve the single-AZ failure risk within the original VPC.

Practice this question →

326

Multi-Selectmedium

A company is designing a VPC with public and private subnets. The private subnets must have outbound internet access for software updates, but must not be directly reachable from the internet. Which two components are required for this design? (Choose two.)

Select 2 answers

A.NAT Gateway in a public subnet

B.Security Group allowing outbound HTTPS

C.Internet Gateway attached to the VPC

D.AWS Site-to-Site VPN connection

E.Route table for private subnets with 0.0.0.0/0 pointing to the NAT Gateway

AnswersA, E

NAT Gateway enables outbound internet access for private instances.

Why this answer

A NAT Gateway in a public subnet (A) provides outbound internet access for instances in private subnets while preventing inbound connections from the internet. A route table for the private subnets with a 0.0.0.0/0 route pointing to the NAT Gateway (E) directs outbound traffic to the NAT Gateway. Option B (Security Group allowing outbound HTTPS) is not a component; security groups control traffic but don't provide routing or internet access.

Option C (Internet Gateway attached to the VPC) is required for public subnets but alone does not enable private subnet outbound access. Option D (Site-to-Site VPN) is for hybrid connectivity, not internet access.

Practice this question →

327

MCQmedium

An application running on EC2 instances in a VPC needs to access an Amazon S3 bucket to read configuration files. The VPC has an S3 VPC endpoint configured. The instances are in a private subnet and have a security group that allows all outbound traffic. The bucket policy allows access from the VPC endpoint. However, the application fails to access the S3 bucket. What is the most likely cause?

A.The network ACL for the private subnet is blocking outbound HTTPS traffic.

B.The VPC endpoint's route table does not include the subnet's route table, so traffic to S3 is not routed through the endpoint.

C.The security group for the EC2 instances has an outbound rule that blocks HTTPS traffic to S3.

D.The S3 bucket policy does not grant access to the VPC endpoint's ID.

AnswerB

VPC endpoints require route table association to route traffic.

Why this answer

The most likely cause is that the VPC endpoint's route table does not include the subnet's route table, meaning traffic from the private subnet to S3 is not routed through the endpoint. Option B is correct because if the subnet's route table lacks a route for the S3 prefix list pointing to the VPC endpoint, traffic will go via a NAT gateway or internet gateway (if configured) or fail if no such connectivity exists. Option A is incorrect because network ACLs are not mentioned and typically allow outbound HTTPS.

Option C is incorrect since the security group allows all outbound traffic. Option D is incorrect because the bucket policy already permits access from the VPC endpoint.

Practice this question →

328

MCQmedium

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. Which configuration will allow this without exposing the instance to inbound internet traffic?

A.Use VPC Gateway Endpoints for S3 and DynamoDB.

B.Attach an Internet Gateway to the VPC and assign a public IP to the instance.

C.Deploy a NAT Gateway in a public subnet and update the private subnet's route table to point default route to the NAT Gateway.

D.Configure a VPN connection from the VPC to an on-premises network that has internet access.

AnswerC

NAT Gateway provides outbound internet access without inbound access.

Why this answer

A NAT Gateway, deployed in a public subnet with an Internet Gateway, allows outbound IPv4 traffic from private subnets to the internet while preventing unsolicited inbound connections. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, enabling the EC2 instance to download patches without being directly exposed.

Exam trap

The trap here is that candidates often confuse NAT Gateways with NAT Instances or assume that a VPC Gateway Endpoint (Option A) provides general internet access, when in fact it only works for specific AWS services like S3 and DynamoDB.

How to eliminate wrong answers

Option A is wrong because VPC Gateway Endpoints only provide private connectivity to S3 and DynamoDB, not general internet access for downloading patches from arbitrary internet hosts. Option B is wrong because assigning a public IP to the instance and attaching an Internet Gateway would expose the instance to inbound internet traffic, violating the requirement to prevent inbound exposure. Option D is wrong because a VPN connection to an on-premises network with internet access would route traffic through the VPN, but this adds complexity, latency, and dependency on on-premises infrastructure; it is not the standard AWS-native solution for outbound-only internet access.

Practice this question →

329

MCQhard

A global company is deploying a multi-Region application on AWS. The application requires low-latency access to a shared dataset that is updated frequently in multiple Regions. The company wants to use Amazon Route 53 latency-based routing to direct users to the closest Region. Which data store provides the best combination of low-latency reads and cross-Region consistency for this use case?

A.Amazon S3 with cross-Region replication

B.Amazon Aurora Global Database

C.Amazon ElastiCache for Redis Global Datastore

D.Amazon DynamoDB global tables with eventually consistent reads

AnswerC

Redis Global Datastore provides sub-millisecond reads and cross-Region replication.

Why this answer

Amazon ElastiCache for Redis Global Datastore provides sub-millisecond read latency by serving data from in-memory caches, and it offers cross-Region consistency by replicating writes from a primary Region to read replicas in secondary Regions with minimal lag. This combination meets the requirement for low-latency access to a frequently updated shared dataset across multiple Regions, as it avoids the higher latency of disk-based storage and the eventual consistency delays of other options.

Exam trap

The trap here is that candidates often assume DynamoDB global tables provide strong consistency across Regions, but they only offer eventual consistency for cross-Region reads, while ElastiCache Global Datastore provides stronger consistency with lower latency for frequently updated datasets.

How to eliminate wrong answers

Option A is wrong because Amazon S3 with cross-Region replication provides eventually consistent reads (due to S3's read-after-write consistency only for new objects in the same Region) and higher latency for frequent updates compared to in-memory caching. Option B is wrong because Amazon Aurora Global Database uses asynchronous replication with typical latency of ~1 second, which is too high for frequently updated datasets requiring near-real-time consistency across Regions. Option D is wrong because Amazon DynamoDB global tables with eventually consistent reads do not guarantee cross-Region consistency; writes are replicated asynchronously, and reads may return stale data, which fails the consistency requirement for a frequently updated shared dataset.

Practice this question →

330

MCQhard

A large e-commerce company is redesigning its global network architecture. They have three VPCs in us-east-1: production (10.0.0.0/16), staging (10.1.0.0/16), and development (10.2.0.0/16). They also have two VPCs in eu-west-1: production (10.10.0.0/16) and staging (10.11.0.0/16). All VPCs are connected via a Transit Gateway with inter-region peering. The company wants to allow the staging VPCs in both regions to communicate with each other for data replication, but no other cross-region traffic should be allowed. Additionally, the production VPC in us-east-1 must be able to send traffic to the production VPC in eu-west-1 for a disaster recovery pilot. The security team has configured Network ACLs and security groups appropriately. However, after implementation, the staging VPCs can communicate, but the production VPCs cannot. A network engineer checks the Transit Gateway route tables and finds that both production VPC attachments are associated with the same route table, which has a static route for the 10.0.0.0/16 and 10.10.0.0/16 prefixes. What is the MOST likely reason for the failure?

A.The security groups in the production VPCs are blocking the traffic

B.The production VPCs are attached to the same Transit Gateway route table, causing asymmetric routing

C.The production VPCs have overlapping CIDR ranges, causing a routing conflict

D.The Transit Gateway route table for the production VPCs does not have a route for the remote production CIDR

AnswerB

If both production VPCs are in the same route table, the route for the remote production CIDR might be incorrectly propagated or cause a loop. They should be in separate route tables to control routing direction.

Why this answer

Transit Gateway route tables propagate routes from VPC attachments. If both production VPCs are in the same route table, the routes for their CIDRs will be propagated. However, if there is a propagated route for the local VPC, it may override the static route or cause a conflict.

The issue is likely that the static routes are being ignored because a more specific or conflicting propagated route exists, or the route table lacks a route for the remote production CIDR if the attachment is not associated correctly. Actually, the most common issue is that the production VPC attachments are in the same route table, but the static route for the remote production CIDR might be pointing to the VPC attachment itself, causing a loop. But the key point: Transit Gateway route tables do not allow overlapping CIDRs.

Since both production VPCs have overlapping CIDRs (10.0.0.0/16 and 10.10.0.0/16 are different), that's not the issue. The issue is likely that the route table has a static route for the remote production CIDR, but the propagation from the local production VPC attachment might be creating a route that is not correct. The best answer is that the production VPC attachments need to be in separate route tables to avoid conflicting routes.

Practice this question →

331

MCQmedium

A company is designing a multi-Region application with an Application Load Balancer (ALB) in each Region fronting an Auto Scaling group of EC2 instances. The application must be accessible via a single DNS name, and traffic should be routed to the closest healthy Region using a latency-based routing policy. Which AWS service should be used as the DNS endpoint to achieve this?

A.Amazon Route 53

B.Amazon CloudFront

C.AWS Global Accelerator

D.AWS Network Load Balancer

AnswerA

Route 53 latency-based routing sends traffic to the AWS endpoint with the lowest latency.

Why this answer

Amazon Route 53 is the correct choice because it supports latency-based routing policies, which direct traffic to the AWS Region that provides the lowest latency for the end user. By configuring a single DNS name with latency records pointing to the ALB endpoints in each Region, Route 53 can automatically route requests to the closest healthy Region, meeting the requirement for a single DNS name and latency-based routing.

Exam trap

The ANS-C01 exam often tests the distinction between DNS-based routing (Route 53) and network-layer traffic steering (Global Accelerator), where candidates mistakenly choose Global Accelerator because they think of 'lowest latency' as a network-layer feature, but the question specifically requires a single DNS name with latency-based routing policy, which is a Route 53 feature.

How to eliminate wrong answers

Option B (Amazon CloudFront) is wrong because CloudFront is a content delivery network (CDN) that caches content at edge locations and uses DNS to route to the nearest edge, not to the closest healthy Region via latency-based routing; it does not provide a latency-based routing policy for regional ALBs. Option C (AWS Global Accelerator) is wrong because it uses Anycast IP addresses and the AWS global network to route traffic to the optimal endpoint, but it does not use a DNS-based latency routing policy; it operates at the network layer (Layer 3/4) and requires a static IP, not a single DNS name with latency records. Option D (AWS Network Load Balancer) is wrong because it is a regional load balancer that operates at Layer 4 and does not provide DNS-based routing policies or multi-Region traffic steering; it cannot route traffic to the closest healthy Region based on latency.

Practice this question →

332

MCQmedium

A company is setting up a new AWS environment for a project. The network architect decides to use a hub-and-spoke model with a central inspection VPC for east-west traffic inspection. The inspection VPC (VPC-Hub) contains a firewall appliance that inspects traffic between spoke VPCs. All VPCs are attached to an AWS Transit Gateway. The architect creates a route table in the Transit Gateway for the inspection VPC and another route table for the spoke VPCs. The inspection VPC route table has a default route (0.0.0.0/0) pointing to the firewall appliance. The spoke VPCs have route tables that point to the inspection VPC for traffic to other spoke VPCs. The firewall appliance is configured to forward traffic after inspection. However, traffic between spoke VPCs is not being routed through the inspection VPC. Which configuration change should the architect make to ensure traffic between spoke VPCs is inspected?

A.Use VPC Peering between the spoke VPCs instead of Transit Gateway

B.Create a static route in the inspection VPC route table for each spoke VPC CIDR

C.Remove the default route from the spoke VPC route tables

D.Enable route propagation on the inspection VPC attachment for the inspection route table

AnswerD

Correct; propagation allows the inspection VPC to learn the spoke CIDRs.

Why this answer

The inspection VPC route table needs to learn the spoke VPC CIDRs dynamically via route propagation from the Transit Gateway attachment. Without propagation, the inspection VPC route table only has a default route pointing to the firewall appliance, but no specific routes for the spoke VPCs. When the firewall appliance forwards traffic after inspection, it needs to know how to reach the destination spoke VPC; enabling route propagation on the inspection VPC attachment for the inspection route table allows the Transit Gateway to inject the spoke VPC routes into that route table, enabling proper return traffic flow.

Exam trap

The trap here is that candidates often focus on the spoke VPC route tables (thinking they need to remove the default route or add static routes) instead of recognizing that the inspection VPC route table must have routes to the spoke VPCs via route propagation to allow the firewall to forward inspected traffic back to the Transit Gateway.

How to eliminate wrong answers

Option A is wrong because using VPC Peering instead of Transit Gateway would bypass the central inspection VPC entirely, defeating the purpose of the hub-and-spoke model for east-west traffic inspection. Option B is wrong because creating a static route in the inspection VPC route table for each spoke VPC CIDR is unnecessary and less scalable; the Transit Gateway can dynamically propagate routes, and static routes would require manual updates as spoke VPCs change. Option C is wrong because removing the default route from the spoke VPC route tables would break all outbound traffic from the spoke VPCs, not just inter-spoke traffic; the default route is needed for internet-bound traffic or other destinations, and the issue is about the inspection VPC route table lacking spoke routes, not the spoke route tables.

Practice this question →

333

MCQhard

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to connect their on-premises data center to AWS using AWS Direct Connect. The data center uses RFC 1918 addresses from the 10.0.0.0/8 range, overlapping with the VPC CIDR. The company cannot change the on-premises IP addresses. Which design allows connectivity without IP conflicts?

A.Configure Direct Connect Gateway with network address translation

B.Use AWS Transit Gateway with route table separation

C.Deploy a Private NAT Gateway in the VPC and configure routes to send on-premises traffic through it

D.Set up VPC Peering between the VPC and on-premises network over Direct Connect

AnswerC

Private NAT Gateway translates VPC IPs to a different range, allowing communication with overlapping on-premises addresses.

Why this answer

A Private NAT Gateway in the VPC allows the on-premises network to reach the VPC by translating overlapping IP addresses. Since the on-premises network uses the same 10.0.0.0/8 range as the VPC's 10.0.0.0/16 CIDR, traffic from the data center to the VPC must be source NATed to a non-overlapping IP range. The Private NAT Gateway performs this translation, enabling bidirectional communication without IP conflicts.

Exam trap

The ANS-C01 exam often tests the misconception that a Direct Connect Gateway or Transit Gateway can resolve IP overlaps, but these services only route traffic and do not perform NAT, making a Private NAT Gateway the only correct solution for overlapping CIDRs.

How to eliminate wrong answers

Option A is wrong because a Direct Connect Gateway does not perform NAT; it is a transit hub for connecting multiple VPCs and on-premises networks via Direct Connect, but it cannot translate overlapping IP addresses. Option B is wrong because AWS Transit Gateway with route table separation can isolate traffic between different networks, but it does not resolve IP address overlap; overlapping CIDRs would still cause routing conflicts. Option D is wrong because VPC Peering is used to connect two VPCs, not an on-premises network, and it does not support Direct Connect; additionally, it cannot handle overlapping IP addresses.

Practice this question →

334

Multi-Selectmedium

A company is designing a hybrid network using AWS Direct Connect. The company wants to use the same Direct Connect connection to access both VPC resources and public AWS services (such as S3 and DynamoDB) from its on-premises network. Which THREE components are required to meet this goal? (Choose three.)

Select 3 answers

A.AWS Transit Gateway

B.Private virtual interface (VIF)

C.Direct Connect Gateway

D.AWS Site-to-Site VPN connection

E.Public virtual interface (VIF)

AnswersB, C, E

Correct; private VIF connects to VPCs.

Why this answer

A private virtual interface (VIF) is required to connect your on-premises network to a VPC via Direct Connect. However, to also access public AWS services like S3 and DynamoDB over the same Direct Connect connection, you need a public VIF (Option E) for public endpoint connectivity and a Direct Connect Gateway (Option C) to enable transitive routing between the private VIF and multiple VPCs or to simplify the architecture. Together, these three components allow a single Direct Connect connection to serve both private VPC resources and public AWS services.

Exam trap

The trap here is that candidates often think a Transit Gateway is required for multi-VPC or hybrid access, but for a single Direct Connect connection to access both VPCs and public services, the essential components are the private VIF, public VIF, and Direct Connect Gateway, not the Transit Gateway.

Practice this question →

335

MCQhard

A company is designing a network for a critical application that requires low latency between EC2 instances. The instances are in the same AWS Region but different Availability Zones. Which configuration will provide the lowest latency?

A.Use an Application Load Balancer to distribute traffic

B.Launch instances in the same placement group within a single Availability Zone

C.Use Direct Connect to connect the VPCs

D.Use VPC peering to connect the VPCs

AnswerB

Placement groups provide low latency by placing instances close together.

Why this answer

Placing EC2 instances within the same placement group in a single Availability Zone ensures they are in close physical proximity, often on the same rack or within the same cluster, which minimizes network hops and achieves the lowest possible latency (typically under 1 ms). This configuration is specifically designed for low-latency, high-throughput workloads like HPC or real-time data processing.

Exam trap

The trap here is that candidates often assume inter-AZ latency is negligible or that services like ALB or VPC peering are designed for low-latency scenarios, but the question specifically asks for the lowest latency, which requires physical co-location within a single AZ using a placement group.

How to eliminate wrong answers

Option A is wrong because an Application Load Balancer operates at Layer 7 and introduces additional network hops and processing overhead, which increases latency compared to direct instance-to-instance communication. Option C is wrong because Direct Connect is a dedicated network connection between on-premises and AWS, not between VPCs or instances within the same Region, and it does not reduce inter-AZ latency. Option D is wrong because VPC peering connects VPCs across different networks and does not optimize physical proximity; instances in different VPCs still communicate over the AWS backbone, which has higher latency than instances in the same placement group.

Practice this question →

336

Matchingmedium

Match each AWS networking feature to its use case for hybrid connectivity.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Central hub connecting multiple VPCs and on-premises networks

Connect multiple VPCs across regions to a single Direct Connect

Hub-and-spoke VPN topology between multiple on-premises sites

Managed OpenVPN-based service for remote users

Private access to S3 and DynamoDB without internet gateway

Why these pairings

Correct matches: Direct Connect = dedicated private connection; Site-to-Site VPN = encrypted internet tunnel; Transit Gateway = central hub. Common confusions include swapping the encryption and dedicated nature of Direct Connect and VPN.

Practice this question →

337

MCQhard

A company has a VPC with multiple subnets. They want to ensure that all outbound traffic from EC2 instances in the VPC goes through a centralized NAT device for inspection. They have deployed a NAT instance in a public subnet and configured the route tables for private subnets to point to the NAT instance. However, traffic is not being routed through the NAT instance. What is the most likely cause?

A.The source/destination check is enabled on the NAT instance.

B.The NAT instance does not have a public IP address.

C.The route table for the private subnets does not have a default route (0.0.0.0/0) pointing to the NAT instance.

D.The security group of the NAT instance blocks outbound traffic.

AnswerA

By default, EC2 instances check that the source or destination of traffic matches their own IP. This must be disabled for NAT instances.

Why this answer

The source/destination check is a security feature on EC2 instances that prevents them from forwarding traffic unless the instance is the source or destination of the packet. Since a NAT instance must forward traffic that it did not originate (e.g., from private instances to the internet), this check must be disabled. When enabled, the NAT instance drops packets that are not addressed to itself, breaking the routing of outbound traffic through it.

Exam trap

The trap here is that candidates often assume the issue is a missing route or security group rule, overlooking the fact that EC2 instances by default cannot act as routers unless the source/destination check is explicitly disabled.

How to eliminate wrong answers

Option B is wrong because a NAT instance in a public subnet can route traffic using an Elastic IP or a public IP assigned to its network interface, but the lack of a public IP would only affect return traffic from the internet, not the outbound path from private instances to the NAT instance. Option C is wrong because the question states that the route tables for private subnets are configured to point to the NAT instance, implying a default route (0.0.0.0/0) is present; if it were missing, traffic would not even attempt to reach the NAT instance. Option D is wrong because security groups are stateful and allow outbound traffic by default; unless explicitly blocked, outbound traffic from the NAT instance is permitted, and the issue is about forwarding traffic, not initiating it.

Practice this question →

338

Multi-Selectmedium

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add IPv6 support for their internet-facing Application Load Balancer. The VPC is already associated with an IPv6 CIDR block. What additional configuration is required? (Choose two.)

Select 2 answers

A.Configure NAT64 and DNS64 on the VPC.

B.Add a route in the subnet's route table for ::/0 to the Internet Gateway.

C.Associate an IPv6 CIDR block with the public subnet where the ALB is deployed.

D.Assign an IPv6 address to the ALB's network interface.

E.Create an Egress-Only Internet Gateway for the VPC.

AnswersB, C

Correct. The route ::/0 to the internet gateway is required to allow IPv6 traffic to and from the internet for the subnet where the ALB resides.

Why this answer

Options B and C are correct. To support IPv6 clients on an internet-facing ALB, the subnet where the ALB is deployed must have an IPv6 CIDR block associated (C), and the subnet's route table must include a route for ::/0 to the internet gateway (B). Option A is incorrect because NAT64/DNS64 is not needed; the ALB natively supports IPv6.

Option D is incorrect because the ALB uses the subnet's IPv6 CIDR, not an assigned IPv6 address on its network interface. Option E is incorrect because an Egress-Only Internet Gateway is used for outbound-only IPv6 traffic from private subnets, not for internet-facing ALBs.

Exam trap

A common trap is thinking that you need to assign an IPv6 address directly to the ALB's network interface, but the ALB inherits IPv6 support from the subnet's IPv6 CIDR.

Practice this question →

339

MCQhard

A global company is designing a multi-region architecture with VPCs in us-east-1, eu-west-1, and ap-southeast-1. They are using AWS Transit Gateway with inter-region peering between all three regions. The company also has on-premises data centers in the US and Europe connected via Direct Connect to the Transit Gateways in us-east-1 and eu-west-1 respectively. The on-premises networks use BGP to advertise their CIDRs (10.0.0.0/8 for US, 172.16.0.0/12 for Europe). The Transit Gateway route tables are configured to propagate routes from all attachments. The company needs all VPCs and on-premises networks to be able to communicate with each other. After configuration, the VPC in ap-southeast-1 can communicate with the VPCs in us-east-1 and eu-west-1, but cannot communicate with either on-premises network. The VPCs in us-east-1 and eu-west-1 can communicate with all on-premises networks. What is the MOST likely cause of this issue?

A.The VPC in ap-southeast-1 has a security group that blocks traffic from on-premises IP ranges

B.The inter-region peering attachments in ap-southeast-1 do not have route propagation enabled

C.The on-premises networks are not advertising their CIDRs to the ap-southeast-1 region

D.The Direct Connect gateways are not attached to the Transit Gateways in us-east-1 and eu-west-1

AnswerB

Without propagation, the ap-southeast-1 Transit Gateway does not learn the on-premises CIDRs from the other regions.

Why this answer

The on-premises CIDRs are advertised via Direct Connect into the Transit Gateways in us-east-1 and eu-west-1. Those Transit Gateways propagate the routes to the inter-region peering attachments. However, the Transit Gateway in ap-southeast-1 needs to have routes for the on-premises CIDRs pointing to the inter-region peering attachments.

This is typically done by enabling route propagation from the inter-region peering attachment. If the route propagation is not enabled, the routes will not be added automatically. The engineer likely assumed propagation works automatically, but it must be explicitly enabled for each attachment.

Since the VPCs in us-east-1 and eu-west-1 can reach on-premises, the local Direct Connect routes are fine. The issue is that the ap-southeast-1 Transit Gateway route table does not have routes for the on-premises CIDRs via the peering attachments.

Practice this question →

340

MCQmedium

A network administrator is troubleshooting connectivity to a web server in subnet with network ACL 'acl-12345678'. The web server is on port 443. The administrator finds that traffic from IP 10.0.1.5 is being denied. Why is the traffic being denied?

A.The subnet is not associated with this network ACL.

B.The security group attached to the web server is blocking the traffic.

C.The network ACL rule 100 denies traffic from 10.0.0.0/8, which includes the IP 10.0.1.5.

D.The network ACL rule 100 allows traffic from 0.0.0.0/0, but rule 200 denies traffic from 10.0.0.0/8, and rule 200 is evaluated first.

AnswerC

Rule 100 matches and denies.

Why this answer

Network ACLs are stateless and evaluated in ascending order by rule number. Rule 100 denies traffic from 10.0.0.0/8, which includes the source IP 10.0.1.5, so any traffic from that IP is denied regardless of later allow rules. Since network ACLs do not track connection state, the deny is applied immediately upon matching rule 100.

Exam trap

The trap here is that candidates often confuse the evaluation order of network ACL rules (ascending by rule number) with the order of security group rules (all evaluated until a match), or mistakenly think that a higher-numbered allow rule overrides a lower-numbered deny rule.

How to eliminate wrong answers

Option A is wrong because if the subnet were not associated with the network ACL, the default network ACL (which allows all traffic) would apply, and traffic would not be denied. Option B is wrong because security groups are stateful and operate at the instance level, not the subnet level; the question specifies the network ACL is the cause, and security groups would not deny traffic from a specific IP unless explicitly configured, but the scenario points to the ACL. Option D is wrong because network ACL rules are evaluated in numerical order from lowest to highest; rule 100 is evaluated before rule 200, so if rule 100 denies the traffic, rule 200 is never reached.

Practice this question →

341

MCQhard

A company is running a latency-sensitive application in a VPC with a public subnet and a private subnet. The application in the private subnet needs to access an Amazon S3 bucket in the same region. The company wants to minimize latency and avoid using a NAT gateway. Which solution meets these requirements?

A.Use S3 Transfer Acceleration and access the bucket via the public endpoint

B.Create a VPC Gateway Endpoint for Amazon S3 and update the route table for the private subnet

C.Attach an Internet Gateway to the VPC and route the private subnet traffic through a NAT instance

D.Set up a NAT gateway in the public subnet and route traffic to the S3 bucket through it

AnswerB

A Gateway Endpoint provides private connectivity to S3 without leaving the AWS network, minimizing latency and avoiding NAT gateway costs.

Why this answer

A VPC Gateway Endpoint for Amazon S3 allows instances in a private subnet to access S3 without traversing the internet or requiring a NAT gateway. This minimizes latency by routing traffic over the AWS internal network, and it avoids the cost and complexity of NAT devices. The route table for the private subnet must be updated with a route pointing to the gateway endpoint for the S3 prefix list.

Exam trap

The trap here is that candidates often assume S3 Transfer Acceleration is always faster, but it is designed for cross-region or long-distance transfers and actually adds latency for same-region traffic due to additional routing and edge location processing.

How to eliminate wrong answers

Option A is wrong because S3 Transfer Acceleration is designed for long-distance transfers over the public internet and does not reduce latency for same-region access; it actually adds overhead. Option C is wrong because routing private subnet traffic through a NAT instance still forces traffic over the internet, increasing latency and requiring a public IP, which contradicts the requirement to avoid a NAT gateway. Option D is wrong because a NAT gateway introduces additional hop latency and cost, and is unnecessary when a VPC Gateway Endpoint provides direct, private connectivity to S3 within the same region.

Practice this question →

342

MCQmedium

A company has a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to make API calls to Amazon S3. Which is the most secure way to provide this access without traffic leaving the AWS network?

A.Use an AWS Site-to-Site VPN to connect to a remote network that has access to S3.

B.Create a VPC gateway endpoint for Amazon S3 and attach it to the route table of the private subnet.

C.Set up a NAT gateway in the public subnet and route the web server's traffic through it.

D.Use an internet gateway and a public IP address on the web server.

AnswerB

Gateway endpoint provides private, secure access to S3.

Why this answer

A VPC gateway endpoint for Amazon S3 allows resources in a private subnet to access S3 privately using the AWS network, without traversing the internet or requiring a NAT gateway. This is the most secure option because traffic stays within the AWS backbone and does not require public IPs or external connectivity.

Exam trap

The trap here is that candidates often choose a NAT gateway (Option C) thinking it provides private outbound access, but they overlook that NAT gateway traffic still goes to the internet, whereas a gateway endpoint keeps traffic entirely within AWS.

How to eliminate wrong answers

Option A is wrong because an AWS Site-to-Site VPN connects to a remote network, which would route traffic outside the VPC and potentially over the internet or a VPN connection, not keeping it within the AWS network. Option C is wrong because a NAT gateway in a public subnet would route traffic through the internet to reach S3, which violates the requirement of not leaving the AWS network and introduces additional security risks. Option D is wrong because using an internet gateway and a public IP address exposes the web server to the internet, increasing the attack surface and again forcing traffic to leave the AWS network.

Practice this question →

343

MCQeasy

A company wants to improve the performance and availability of its application that is deployed on EC2 instances in a single Availability Zone. Which architecture should the company implement?

A.Add more subnets in the same Availability Zone

B.Deploy EC2 instances in multiple Availability Zones

C.Use larger EC2 instances

D.Use Auto Scaling in the same Availability Zone

AnswerB

Multi-AZ deployment provides high availability.

Why this answer

Deploying EC2 instances across multiple Availability Zones (AZs) improves both performance and availability by eliminating a single point of failure. If one AZ experiences an outage, traffic can be routed to healthy instances in another AZ using an Elastic Load Balancer or Route 53 DNS failover. This architecture also distributes the load, reducing latency for users in different geographic regions.

Exam trap

The ANS-C01 exam often tests the misconception that adding more subnets or using Auto Scaling within a single AZ improves availability, when in reality only distributing resources across multiple AZs provides true fault tolerance.

How to eliminate wrong answers

Option A is wrong because adding more subnets within the same AZ does not provide fault isolation; all subnets in a single AZ share the same underlying infrastructure and are subject to the same failure domain. Option C is wrong because using larger EC2 instances only increases compute capacity, not availability; a single AZ failure still takes all instances offline regardless of size. Option D is wrong because Auto Scaling in the same AZ only replaces failed instances within that same AZ, which does not protect against an AZ-wide outage.

Practice this question →

344

MCQmedium

A company is designing a VPC with subnets in multiple Availability Zones (AZs) for a web application. The application must be fault-tolerant and highly available. Which design should the network engineer implement?

A.Deploy all application instances in a single AZ behind an Application Load Balancer.

B.Place one instance in each of two AZs and use an internet gateway for load balancing.

C.Deploy application instances in two AZs behind an Application Load Balancer that spans both AZs.

D.Use a Network Load Balancer in a single AZ with instances in multiple AZs.

AnswerC

This provides fault tolerance and high availability across AZs.

Why this answer

Deploying application instances in two Availability Zones (AZs) behind an Application Load Balancer (ALB) that spans both AZs provides fault tolerance and high availability. If one AZ fails, the ALB automatically routes traffic to healthy instances in the remaining AZ, ensuring continuous service. This design leverages cross-zone load balancing, which is enabled by default for ALBs, to distribute traffic evenly across instances in multiple AZs.

Exam trap

The trap here is that candidates often assume a single load balancer in one AZ is sufficient if instances are in multiple AZs, but they overlook that the load balancer itself must be deployed across multiple AZs to avoid being a single point of failure.

How to eliminate wrong answers

Option A is wrong because deploying all application instances in a single AZ creates a single point of failure; if that AZ experiences an outage, the entire application becomes unavailable, violating fault-tolerance requirements. Option B is wrong because an internet gateway is a VPC component for internet connectivity, not a load balancer; it cannot perform health checks or distribute traffic across instances, so it provides no load balancing or high availability. Option D is wrong because a Network Load Balancer (NLB) in a single AZ cannot route traffic to instances in other AZs unless cross-zone load balancing is explicitly enabled, and even then, the NLB itself is a single point of failure if that AZ fails; the design does not meet high availability standards.

Practice this question →

345

MCQmedium

An e-commerce company runs a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. During a flash sale, the application experiences high latency. The network team notices that the ALB is receiving more traffic than expected. What is the most likely cause?

A.The ALB is configured to terminate HTTPS, which increases CPU load on the ALB.

B.The Auto Scaling group's scaling policies are too aggressive, causing frequent instance launches.

C.The ALB health checks are too frequent, consuming resources.

D.The ALB is not protected by AWS WAF, allowing a DDoS attack or excessive traffic to reach the backend.

AnswerD

Without WAF, the ALB can be targeted by attacks that consume its capacity.

Why this answer

The sudden spike in traffic reaching the ALB beyond expected levels, combined with high latency, strongly indicates that the ALB is being overwhelmed by malicious or excessive traffic. Without AWS WAF protection, the ALB cannot filter out DDoS attacks or unwanted requests at Layer 7, so all traffic passes through to the backend instances, causing resource exhaustion and latency. AWS WAF integrates directly with ALBs to inspect and block malicious traffic before it reaches the application.

Exam trap

The trap here is that candidates may assume high latency is always caused by backend scaling issues (Option B) or health check overhead (Option C), but the key clue is 'ALB is receiving more traffic than expected,' which points directly to an external traffic source, not internal configuration problems.

How to eliminate wrong answers

Option A is wrong because HTTPS termination at the ALB does increase CPU usage on the ALB node, but this is a normal, expected operation and would not cause the ALB to receive 'more traffic than expected' — it only processes the traffic it receives. Option B is wrong because aggressive Auto Scaling policies cause more frequent instance launches, which could temporarily increase load on the ALB during scale-up events, but this does not explain why the ALB itself is receiving more traffic than expected; scaling policies respond to traffic, they don't generate it. Option C is wrong because ALB health checks are lightweight HTTP/HTTPS requests sent to the target group instances, not to the ALB itself, and they consume negligible resources on the ALB; they do not increase the traffic volume reaching the ALB.

Practice this question →

346

Multi-Selectmedium

Which TWO of the following are valid methods to connect a VPC to an on-premises network? (Choose 2.)

Select 2 answers

A.AWS Site-to-Site VPN

B.Internet gateway

C.NAT gateway

D.VPC peering

E.AWS Direct Connect

AnswersA, E

Valid method.

Why this answer

AWS Site-to-Site VPN creates an encrypted tunnel between a VPC and an on-premises network using IPsec. It uses a virtual private gateway or transit gateway on the AWS side and a customer gateway device on-premises, enabling secure communication over the public internet.

Exam trap

The trap here is that candidates often confuse internet-facing connectivity options (internet gateway, NAT gateway) with hybrid connectivity methods, or mistakenly think VPC peering can extend to on-premises networks, when it is strictly limited to inter-VPC communication within AWS.

Practice this question →

347

MCQmedium

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to add a second CIDR block of 10.1.0.0/16 for additional subnets. After adding the CIDR, the existing subnets cannot communicate with the new subnets. What is the most likely cause?

A.Security groups are blocking traffic between the old and new subnets.

B.The VPC CIDR cannot be extended; a new VPC must be created.

C.Route tables for the existing subnets do not have routes to the new CIDR.

D.Network ACLs are blocking traffic by default.

AnswerC

Route tables must include routes for the new CIDR to enable communication.

Why this answer

When adding a secondary CIDR to a VPC, route tables for existing subnets must be updated to include routes to the new CIDR block; otherwise, traffic destined for the new subnets will not be routed correctly. Option A is wrong because security groups are stateful and automatically allow return traffic; they are not the cause of connectivity loss when adding a new CIDR. Option B is wrong because you can add a secondary CIDR to an existing VPC without creating a new VPC.

Option D is wrong because Network ACLs are stateless but are not the primary issue; the problem is the missing routes in the route tables.

Practice this question →

348

MCQeasy

A company has a VPC with a CIDR block of 192.168.0.0/16. They have two subnets: Subnet A (192.168.1.0/24) and Subnet B (192.168.2.0/24). They launch an EC2 instance in Subnet A and another EC2 instance in Subnet B. They want to ensure that both instances can communicate with each other. The instances are in the same VPC. What is the simplest way to enable communication between these instances?

A.Create a VPC Peering connection between Subnet A and Subnet B

B.No additional configuration is needed; instances in the same VPC can communicate by default

C.Create a NAT Gateway in each subnet

D.Attach an internet gateway to the VPC

AnswerB

Default VPC routing allows communication between subnets.

Why this answer

By default, all instances within the same VPC can communicate with each other using private IP addresses, regardless of which subnet they reside in. The VPC's implicit router enables this layer-3 connectivity as long as the subnets' route tables do not explicitly block traffic and the instances' security groups or network ACLs permit the traffic. Since both subnets are within the same VPC (192.168.0.0/16), no additional configuration is required for basic IP-level communication.

Exam trap

The trap here is that candidates may overthink the scenario and assume that different subnets require explicit routing or peering, when in fact the VPC's implicit local route already handles all intra-VPC traffic by default.

How to eliminate wrong answers

Option A is wrong because VPC peering connects entire VPCs, not subnets, and is unnecessary when instances are already in the same VPC. Option C is wrong because a NAT Gateway is used to enable outbound internet access for instances in private subnets, not to enable communication between instances within the same VPC. Option D is wrong because an internet gateway provides internet connectivity, not internal VPC communication, and attaching it does not affect intra-VPC routing.

Practice this question →

349

MCQeasy

A solutions architect is designing a VPC with public and private subnets in two Availability Zones. The private subnets require outbound internet access for software updates, but inbound internet access must be blocked. Which solution meets these requirements?

A.Attach an internet gateway to the VPC and add a default route to the internet gateway in the private subnet route tables.

B.Deploy a NAT Gateway in a public subnet and add a default route to the NAT Gateway in the private subnet route tables.

C.Launch an EC2 instance in a public subnet with a proxy software and route private subnet traffic through it.

D.Create a VPC endpoint for Amazon S3 and add a route to the endpoint in the private subnet route tables.

AnswerB

NAT Gateway provides outbound-only internet access.

Why this answer

A NAT Gateway, deployed in a public subnet with an Elastic IP and a route to an Internet Gateway, enables outbound traffic from private subnets to the internet while blocking unsolicited inbound connections. The private subnet route table directs default traffic (0.0.0.0/0) to the NAT Gateway, which performs source network address translation (SNAT) on outbound packets, ensuring responses return to the NAT Gateway without exposing private instances directly.

Exam trap

The trap here is that candidates may confuse a NAT Gateway with an Internet Gateway, thinking that a default route to an Internet Gateway in a private subnet is acceptable, but an Internet Gateway allows bidirectional traffic, which would expose private instances to inbound internet connections.

How to eliminate wrong answers

Option A is wrong because adding a default route to an internet gateway in a private subnet route table would make the private subnet effectively public, allowing inbound internet traffic to reach instances directly, violating the requirement to block inbound access. Option C is wrong because while an EC2 instance with proxy software could provide outbound access, it introduces a single point of failure, requires ongoing management (patching, scaling), and is less reliable and cost-effective than a managed NAT Gateway, which is the recommended AWS solution. Option D is wrong because a VPC endpoint for Amazon S3 only provides private connectivity to S3, not general outbound internet access for software updates from arbitrary sources on the internet.

Practice this question →

350

MCQeasy

A company has a VPC with CIDR 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 10.0.0.0/8. They plan to use AWS Direct Connect with a private virtual interface. What should they do to resolve the overlapping CIDR conflict?

A.Create a VPN connection with dynamic routing and use BGP to advertise the VPC CIDR.

B.Create a VPC peering connection between the VPC and the on-premises network.

C.Change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16, and re-create the VPC with the new CIDR.

D.Use a NAT Gateway in the VPC to translate the on-premises IP addresses.

AnswerC

The only solution is to use non-overlapping IP address ranges.

Why this answer

AWS does not support network address translation (NAT) for overlapping CIDRs on a Direct Connect private virtual interface. The only way to resolve the conflict is to change the VPC CIDR to a non-overlapping range (e.g., 172.16.0.0/16) and recreate the VPC, as the VPC CIDR cannot be modified after creation. This ensures that routes between the VPC and on-premises network do not conflict.

Exam trap

The trap here is that candidates assume NAT or VPN can magically resolve overlapping IP ranges, but AWS Direct Connect private VIFs require non-overlapping CIDRs for proper routing, and no AWS service (including NAT Gateway or VPN) can translate on-premises IPs in this context.

How to eliminate wrong answers

Option A is wrong because a VPN connection with dynamic routing does not resolve overlapping CIDRs; BGP would still advertise the conflicting 10.0.0.0/16 into the on-premises network, causing routing loops or blackholing. Option B is wrong because VPC peering does not support overlapping CIDRs and cannot connect a VPC to an on-premises network; it only connects VPCs within AWS. Option D is wrong because a NAT Gateway translates traffic from private instances to the internet, not from the VPC to on-premises; it cannot translate on-premises IP addresses and does not resolve overlapping CIDR conflicts in a Direct Connect private VIF.

Practice this question →

351

Multi-Selecthard

A company wants to use AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to centrally manage and enforce security policies. Which THREE components are required?

Select 3 answers

A.Transit Gateway route tables

B.VPC Gateway Endpoints

C.AWS Resource Access Manager (RAM)

D.AWS Direct Connect Gateway

E.AWS Network Firewall

AnswersA, C, E

Route tables control how traffic is routed between attachments.

Why this answer

Transit Gateway route tables (A) are required to control the routing of traffic between attached VPCs, VPNs, and Direct Connect connections. They allow you to isolate or share networks by defining which attachments can communicate with each other, enabling centralized policy enforcement.

Exam trap

The trap here is that candidates often confuse optional integration components (like Direct Connect Gateway or Gateway Endpoints) with the mandatory building blocks required to centrally manage and enforce security policies across a Transit Gateway topology.

Practice this question →

352

MCQeasy

A company has a VPC with public and private subnets. The private subnets need outbound internet access for software updates. Which design will meet this requirement most securely?

A.Deploy a NAT Gateway in a public subnet and add a route to it from the private subnets.

B.Add a default route to the IGW from the private subnet route table.

C.Place the instances in a public subnet with a route to an Internet Gateway (IGW).

D.Deploy a NAT instance in a private subnet and configure routes to it.

AnswerA

NAT Gateway allows outbound traffic from private subnets while blocking inbound traffic.

Why this answer

A NAT Gateway deployed in a public subnet with an Elastic IP allows private subnet instances to initiate outbound connections to the internet (e.g., for software updates) while preventing unsolicited inbound connections. The private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, which then forwards traffic to the Internet Gateway (IGW) in the public subnet. This design is the most secure because it avoids exposing private instances directly to the internet and uses a managed, highly available service.

Exam trap

AWS often tests the misconception that a NAT instance can be placed in a private subnet and still provide outbound internet access, but in reality, a NAT device must reside in a public subnet with a route to an IGW to translate and forward traffic.

How to eliminate wrong answers

Option B is wrong because adding a default route to the IGW from the private subnet route table would directly expose private instances to the internet, allowing unsolicited inbound traffic and bypassing any NAT functionality, which violates security best practices. Option C is wrong because placing instances in a public subnet with a route to an IGW gives them public IP addresses and direct internet access, making them vulnerable to inbound attacks and defeating the purpose of using private subnets for security. Option D is wrong because deploying a NAT instance in a private subnet would require a route to an IGW or another NAT device for outbound traffic, creating a circular dependency; NAT instances must be in a public subnet to reach the IGW, and using a NAT instance also introduces single points of failure and management overhead compared to a managed NAT Gateway.

Practice this question →

353

MCQeasy

A company has an AWS Direct Connect connection and wants to use it to access Amazon S3 buckets without traversing the public internet. Which virtual interface type should be used?

A.Transit virtual interface

B.Hosted virtual interface

C.Private virtual interface

D.Public virtual interface

AnswerD

Public VIF provides access to public AWS services over Direct Connect.

Why this answer

A public virtual interface is the correct choice because it allows access to AWS public services, such as Amazon S3, over a Direct Connect connection without traversing the public internet. It uses the same BGP peering and routing policies as private virtual interfaces but directs traffic to the public IP address space of AWS services, ensuring traffic stays within the AWS global network.

Exam trap

The trap here is that candidates often confuse 'private' with 'secure' and assume a private virtual interface is needed for any non-internet access, not realizing that public virtual interfaces are specifically designed for AWS public services and still provide private, dedicated connectivity over Direct Connect.

How to eliminate wrong answers

Option A is wrong because a transit virtual interface is used to connect a Direct Connect gateway to a transit gateway, enabling connectivity to multiple VPCs and VPNs, not directly to Amazon S3. Option B is wrong because a hosted virtual interface is provisioned by an AWS Direct Connect partner for use by a customer, but it can be either private or public; the type (public) is what matters for S3 access, not the hosting model. Option C is wrong because a private virtual interface is used to access resources within a VPC using private IP addresses, not AWS public services like S3, which require routing to public endpoints.

Practice this question →

354

MCQmedium

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in us-east-1 and a Network Load Balancer (NLB) in eu-west-1. They need to route traffic from the ALB to the NLB using a fixed IP address. Which AWS service should be used to provide a static IP for the NLB and enable cross-region load balancing?

A.AWS WAF

B.Amazon CloudFront

C.AWS Transit Gateway

D.AWS Global Accelerator

AnswerD

Global Accelerator provides static IPs and can route to NLB across regions.

Why this answer

AWS Global Accelerator provides two static anycast IP addresses that serve as a fixed entry point for traffic. It can route traffic from the ALB in us-east-1 to the NLB in eu-west-1 by using an endpoint group that includes the NLB's IP address, enabling cross-region load balancing with a static IP. This allows the ALB to forward traffic to the Global Accelerator's static IP, which then optimally routes to the NLB in the other region.

Exam trap

The trap here is that candidates often confuse Amazon CloudFront's ability to serve content with a static IP (via custom origins) with the need for a fixed IP that routes traffic from an ALB to an NLB across regions, overlooking that Global Accelerator is specifically designed for this use case with TCP/UDP traffic and static anycast IPs.

How to eliminate wrong answers

Option A is wrong because AWS WAF is a web application firewall that protects against common web exploits, not a service for providing static IP addresses or cross-region routing. Option B is wrong because Amazon CloudFront is a content delivery network (CDN) that uses edge locations and can have static IPs via custom origins, but it is designed for HTTP/HTTPS traffic and does not natively support routing traffic from an ALB to an NLB with a fixed IP for cross-region load balancing; it also does not provide a static IP for the NLB itself. Option C is wrong because AWS Transit Gateway is a network transit hub to connect VPCs and on-premises networks within a region or across regions using peering attachments, but it does not provide static IP addresses for load balancers and is not designed to route traffic from an ALB to an NLB with a fixed IP endpoint.

Practice this question →

355

MCQhard

A company is designing a multi-Region architecture using AWS Transit Gateway and Direct Connect. They have VPCs in us-east-1 and eu-west-1, each with an attached Transit Gateway. The Direct Connect gateway is associated with the Transit Gateway in us-east-1. They need to enable communication between VPCs across Regions using the Direct Connect gateway. What is the correct design to achieve this?

A.Create a single Transit Gateway that spans both Regions and attach VPCs in both Regions.

B.Use VPC peering between the VPCs and route Direct Connect traffic through the VPC peering connection.

C.Create a Transit Gateway peering attachment between the Transit Gateways in us-east-1 and eu-west-1, and route traffic over the Direct Connect gateway via the peering.

D.Associate the Direct Connect gateway with both Transit Gateways in us-east-1 and eu-west-1.

AnswerC

Transit Gateway peering enables inter-Region connectivity. The Direct Connect gateway remains associated with the Transit Gateway in us-east-1, and routes can be propagated to allow traffic to flow across the peering.

Why this answer

Transit Gateway peering attachments allow transitive routing between Transit Gateways in different AWS Regions. By establishing a peering attachment between the Transit Gateways in us-east-1 and eu-west-1, traffic from the VPC in eu-west-1 can be routed through its local Transit Gateway, across the peering attachment to the Transit Gateway in us-east-1, and then over the Direct Connect gateway to on-premises networks. This design enables cross-region VPC communication via Direct Connect without requiring a single Transit Gateway or direct VPC peering.

Exam trap

The trap here is that candidates often assume a Direct Connect gateway can be associated with multiple Transit Gateways across regions, but AWS only supports a one-to-one association between a Direct Connect gateway and a Transit Gateway at a time, requiring Transit Gateway peering for cross-region connectivity.

How to eliminate wrong answers

Option A is wrong because a single Transit Gateway cannot span multiple AWS Regions; Transit Gateways are regional resources and cannot be shared across regions. Option B is wrong because VPC peering does not support transitive routing through a Direct Connect gateway; traffic would need to traverse the peering connection, but Direct Connect traffic cannot be routed through a VPC peering connection to reach another VPC without additional complex routing and potential asymmetric routing issues. Option D is wrong because a Direct Connect gateway can only be associated with a single Transit Gateway in one Region at a time; associating it with both Transit Gateways is not supported and would cause routing conflicts.

Practice this question →

356

MCQmedium

A company is using AWS Organizations to manage multiple accounts. The network team needs to allow a centralized inspection VPC to inspect all traffic between VPCs in different accounts. Which AWS service should be used to route traffic through the inspection VPC?

A.AWS Transit Gateway

B.VPC peering connections

C.AWS PrivateLink

D.AWS Site-to-Site VPN

AnswerA

Transit Gateway supports transitive routing and central inspection.

Why this answer

AWS Transit Gateway acts as a central hub for inter-VPC and inter-account traffic, enabling you to attach VPCs from multiple AWS accounts (via AWS Organizations) and route traffic through a centralized inspection VPC. By using Transit Gateway route tables and a dedicated inspection VPC with appliances (e.g., firewall), you can enforce traffic inspection for all cross-account VPC communications without requiring individual peering connections.

Exam trap

The trap here is that candidates often confuse VPC peering's ability to connect VPCs with the need for transitive routing, mistakenly thinking they can chain multiple peering connections to route traffic through an inspection VPC, but VPC peering explicitly does not support transitive routing.

How to eliminate wrong answers

Option B is wrong because VPC peering connections only allow direct, one-to-one connectivity between two VPCs and do not support transitive routing; you cannot route traffic from one peered VPC through another VPC for inspection. Option C is wrong because AWS PrivateLink provides private connectivity to specific services or endpoints (e.g., NLB-backed services) and is not designed for routing general inter-VPC traffic through a centralized inspection point. Option D is wrong because AWS Site-to-Site VPN is used to connect on-premises networks to AWS VPCs, not for routing traffic between VPCs within AWS.

Practice this question →

357

MCQeasy

A company wants to provide secure access to an S3 bucket from a VPC without using an internet gateway or NAT device. Which AWS feature should be used?

A.Internet gateway

B.NAT gateway

C.AWS Site-to-Site VPN connection

D.VPC endpoint (Gateway type) for S3

AnswerD

A Gateway VPC endpoint provides private access to S3.

Why this answer

A VPC endpoint (Gateway type) for S3 allows instances within a VPC to access S3 buckets privately using the AWS network, without requiring an internet gateway or NAT device. This is achieved by adding an endpoint route in the VPC route table that directs S3 traffic through the AWS backbone, ensuring data never traverses the public internet.

Exam trap

AWS often tests the misconception that a NAT gateway alone provides private S3 access, but candidates must remember that NAT gateways still require an internet gateway and do not eliminate internet transit for S3 traffic.

How to eliminate wrong answers

Option A is wrong because an internet gateway provides direct internet access, which is explicitly not allowed per the requirement to avoid internet gateways or NAT devices. Option B is wrong because a NAT gateway enables outbound internet traffic from private subnets, but it still relies on an internet gateway and public IPs, violating the no-internet-gateway condition. Option C is wrong because an AWS Site-to-Site VPN connection extends an on-premises network to the VPC over the internet, but it does not provide direct private access to S3 from within the VPC without additional routing and still uses the internet for the VPN tunnel.

Practice this question →

358

MCQhard

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group behind a Network Load Balancer (NLB). The application requires that all packets from a given client session are sent to the same target instance for the duration of the session. Which feature should be enabled on the NLB to meet this requirement?

A.Enable proxy protocol v2

B.Enable cross-zone load balancing

C.Enable stickiness using the source IP address

D.Configure health checks to mark targets as healthy

AnswerC

NLB uses a consistent hash based on source IP, protocol, and port to route packets from the same client to the same target, ensuring session persistence.

Why this answer

Enabling stickiness using the source IP address on a Network Load Balancer (NLB) ensures that all packets from a given client IP are routed to the same target instance for the duration of the session. This is achieved by the NLB hashing the source IP address (and optionally port and protocol) to consistently select the same target, which meets the requirement for session persistence without relying on application-layer cookies.

Exam trap

The trap here is that candidates often confuse Proxy Protocol v2 with session persistence, thinking that passing client IP information to the backend automatically ensures stickiness, when in fact Proxy Protocol only provides metadata and does not influence load balancer routing decisions.

How to eliminate wrong answers

Option A is wrong because Proxy Protocol v2 is a mechanism for passing client connection metadata (such as source IP and port) to the backend targets, but it does not provide any session persistence or stickiness; it simply adds a header to the forwarded traffic. Option B is wrong because cross-zone load balancing distributes traffic evenly across targets in all Availability Zones, which can actually break session persistence by sending packets from the same client to different targets across zones. Option D is wrong because health checks only determine whether a target is considered healthy or unhealthy for traffic routing; they do not influence which target receives packets from a specific client session.

Practice this question →

359

MCQeasy

A company is designing a hybrid network using AWS Direct Connect. They want to extend their on-premises network to multiple VPCs in the same AWS Region. Which resource should they use to achieve this?

A.Direct Connect transit virtual interface

B.Direct Connect gateway

C.Direct Connect private virtual interface (VIF)

D.Link Aggregation Group (LAG)

AnswerB

A Direct Connect gateway allows a single private virtual interface to connect to multiple VPCs in the same Region, satisfying the requirement to extend the on-premises network to more than one VPC without provisioning separate virtual interfaces per VPC. This gateway aggregates traffic across VPCs, enabling transitive routing while keeping each VPC’s route table isolated.

Why this answer

A Direct Connect gateway is the correct resource because it allows you to associate up to 10 VPCs (or 20 with a quota increase) in the same or different AWS Regions with a single Direct Connect connection. It acts as a central hub, enabling connectivity from your on-premises network to multiple VPCs via a single private virtual interface (VIF) attached to the Direct Connect gateway, without needing separate VIFs per VPC.

Exam trap

The trap here is that candidates often confuse a Direct Connect gateway with a transit gateway or a private VIF, mistakenly thinking a private VIF alone can connect to multiple VPCs, but AWS requires a Direct Connect gateway to aggregate multiple VPC associations under a single VIF.

How to eliminate wrong answers

Option A is wrong because a Direct Connect transit virtual interface is used to connect to a transit gateway, not directly to multiple VPCs; it requires a transit gateway in between and is typically used for large-scale multi-VPC architectures. Option C is wrong because a Direct Connect private virtual interface (VIF) can only connect to a single VPC (or a Direct Connect gateway) and cannot directly extend to multiple VPCs on its own. Option D is wrong because a Link Aggregation Group (LAG) is a logical bundle of multiple physical connections to increase bandwidth or provide redundancy, but it does not provide the logical routing or multi-VPC connectivity needed for this scenario.

Practice this question →

360

MCQmedium

A network engineer deploys this CloudFormation template. After deployment, an EC2 instance launched in PublicSubnet1 cannot reach the internet. What is the most likely cause?

A.The Internet Gateway is not attached to the VPC.

B.The subnet does not have a route to the Internet Gateway because the route table is not associated with the subnet.

C.The subnet does not have MapPublicIpOnLaunch set to true.

D.The security group is blocking outbound traffic.

AnswerB

The template does not associate the custom route table with PublicSubnet1; it uses the main route table which lacks the IGW route.

Why this answer

The most likely cause is that the route table containing the default route (0.0.0.0/0) pointing to the Internet Gateway is not associated with PublicSubnet1. Without this association, traffic from the subnet has no path to the Internet Gateway, even if the IGW is attached to the VPC. CloudFormation templates often create separate route tables and subnets, and a missing subnet-to-route-table association is a common misconfiguration.

Exam trap

AWS often tests the distinction between having an Internet Gateway attached to the VPC (which is necessary but not sufficient) and having a proper route table association with a default route to that IGW, leading candidates to mistakenly select Option A when the real issue is the missing subnet-to-route-table linkage.

How to eliminate wrong answers

Option A is wrong because if the Internet Gateway were not attached to the VPC, no subnet in the VPC could reach the internet, but the question specifies only PublicSubnet1 has the issue, implying the IGW is attached. Option C is wrong because MapPublicIpOnLaunch controls whether an auto-assigned public IPv4 address is given to the instance, but even without a public IP, the instance could still reach the internet via a NAT device or an Elastic IP; the core issue is routing, not IP assignment. Option D is wrong because security groups by default allow all outbound traffic (unless explicitly modified), and the question does not indicate any custom outbound deny rule; the problem is at the subnet routing layer, not the instance firewall.

Practice this question →

361

MCQeasy

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has an internet gateway attached to the VPC and a NAT gateway in a public subnet. Which route table configuration is required for the private subnets to access the internet?

A.Add a route in the private subnet route table with destination 0.0.0.0/0 and target the internet gateway.

B.Add a route in the private subnet route table with destination 0.0.0.0/0 and target the NAT gateway.

C.Add a route in the public subnet route table with destination 0.0.0.0/0 and target the NAT gateway.

D.Add a route in the private subnet route table with destination 0.0.0.0/0 and target the internet gateway, and associate an Elastic IP with the NAT gateway.

AnswerB

This allows private instances to use NAT for internet access.

Why this answer

Private subnets require a default route (0.0.0.0/0) pointing to the NAT gateway to enable outbound internet access while preventing inbound traffic from the internet. The NAT gateway, residing in a public subnet with an associated Elastic IP, translates private IP addresses to the Elastic IP for internet-bound traffic. The internet gateway is used by public subnets, not private subnets, for direct internet access.

Exam trap

AWS often tests the misconception that private subnets can use the internet gateway directly via a default route, but the trap here is that private subnets must route through a NAT gateway or NAT instance to maintain their private nature and avoid direct inbound internet access.

How to eliminate wrong answers

Option A is wrong because adding a route with destination 0.0.0.0/0 targeting the internet gateway in a private subnet route table would allow direct inbound traffic from the internet, bypassing the NAT gateway and defeating the purpose of a private subnet. Option C is wrong because modifying the public subnet route table does not affect traffic originating from private subnets; private subnets have their own route table that must direct traffic to the NAT gateway. Option D is wrong because associating an Elastic IP with the NAT gateway is already a requirement for its operation, but the route in the private subnet route table must target the NAT gateway, not the internet gateway; targeting the internet gateway would still allow direct internet access without NAT.

Practice this question →

362

MCQeasy

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. It needs to connect to an on-premises data center via AWS Direct Connect. The on-premises network uses 10.0.0.0/8. Which action should the network engineer take to avoid IP address overlap?

A.Use a NAT gateway to translate the VPC addresses when connecting to on-premises.

B.Use AWS Direct Connect gateway to automatically handle overlapping IPs.

C.Add a secondary CIDR block to the VPC and use it for resources that need to connect to on-premises.

D.Create a new VPC with a non-overlapping CIDR block, such as 172.16.0.0/16, and migrate resources.

AnswerD

Changing the VPC CIDR to a non-overlapping range solves the conflict.

Why this answer

The VPC CIDR 10.0.0.0/16 is a subset of the on-premises 10.0.0.0/8, creating an overlap that prevents Direct Connect routing. AWS does not support overlapping IP spaces across a Direct Connect virtual interface; the only viable solution is to use a non-overlapping CIDR (e.g., 172.16.0.0/16) for the VPC and migrate resources to it.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT gateway or Direct Connect gateway can magically resolve IP overlap, but neither provides NAT for private VIF traffic, and the only correct solution is to avoid overlapping CIDRs entirely.

How to eliminate wrong answers

Option A is wrong because a NAT gateway translates source IPs for outbound traffic to the internet, not for Direct Connect traffic; it cannot resolve overlapping IPs in a private VIF scenario, and AWS does not support NAT for Direct Connect private virtual interfaces. Option B is wrong because a Direct Connect gateway aggregates virtual interfaces and transit gateways but does not perform IP address translation or automatically handle overlapping IPs; overlapping CIDRs still cause routing conflicts. Option C is wrong because adding a secondary CIDR to the VPC does not eliminate the overlap with the on-premises 10.0.0.0/8; the VPC’s primary CIDR (10.0.0.0/16) still overlaps, and both CIDRs are advertised, causing routing ambiguity.

Practice this question →

363

MCQmedium

A company is designing a multi-region active-active architecture with Amazon Route 53. The application is deployed behind Application Load Balancers (ALBs) in us-east-1 and eu-west-1. The company wants to minimize latency for users and provide automatic failover. Which routing policy should be used?

A.Failover routing policy

B.Geolocation routing policy

C.Latency-based routing policy

D.Weighted routing policy

AnswerC

Latency-based routing directs users to the endpoint with the lowest latency and supports health checks for automatic failover.

Why this answer

Latency-based routing policy is the correct choice because it directs traffic to the AWS region that provides the lowest latency for the end user, which aligns with the requirement to minimize latency. Additionally, Route 53 automatically performs health checks on the ALBs; if one region's ALB becomes unhealthy, Route 53 routes traffic to the healthy region, providing automatic failover in an active-active architecture.

Exam trap

The ANS-C01 exam often tests the misconception that geolocation routing is the best choice for minimizing latency, but geolocation routes based on political boundaries rather than actual network performance, which can lead to suboptimal routing.

How to eliminate wrong answers

Option A is wrong because failover routing policy is designed for active-passive setups where primary and secondary endpoints are explicitly defined; it does not consider latency and would not route users to the lowest-latency region. Option B is wrong because geolocation routing policy routes traffic based on the user's geographic location, not on actual network latency, and it does not provide automatic failover if the endpoint in the designated region becomes unhealthy. Option D is wrong because weighted routing policy distributes traffic based on assigned weights, which does not minimize latency for individual users and does not inherently provide automatic failover based on endpoint health.

Practice this question →

364

Multi-Selecthard

A company has a VPC with a CIDR of 10.0.0.0/16 and wants to connect to another VPC with CIDR 10.0.0.0/16 in a different account. The VPCs are in the same region. Which THREE steps are necessary to establish connectivity? (Choose THREE.)

Select 3 answers

A.Change the CIDR block of one VPC to a non-overlapping range.

B.Create VPC endpoints in each VPC for the other VPC's services.

C.Set up a VPN connection between the VPCs.

D.Create a VPC peering connection request from one account and accept it in the other.

E.Update route tables in both VPCs to add routes for the peered VPC CIDR.

AnswersA, D, E

Overlapping CIDRs prevent direct peering.

Why this answer

VPC peering requires non-overlapping CIDR blocks. Since both VPCs use 10.0.0.0/16, they have identical address spaces, which makes routing ambiguous and prevents the peering connection from being established. AWS enforces this rule to ensure that route tables can uniquely direct traffic between the peered VPCs without conflicts.

Exam trap

The ANS-C01 exam often tests the misconception that overlapping CIDRs can be resolved by simply updating route tables, but AWS strictly prohibits VPC peering with overlapping CIDRs, making a CIDR change mandatory before any routing can be configured.

Practice this question →

365

Multi-Selectmedium

A financial services company is designing a VPC with multiple tiers: web, application, and database. The web tier must be accessible from the internet, but the application and database tiers must not have direct internet access. The company needs to allow the application tier to download patches from the internet. Which THREE components should be included in the design? (Choose three.)

Select 3 answers

A.Direct Connect virtual interface

B.VPC Peering connection

C.Internet Gateway (IGW)

D.NAT Gateway in a public subnet

E.Public subnet for the web tier

AnswersC, D, E

IGW is required for the public subnet to receive internet traffic.

Why this answer

An Internet Gateway (IGW) is required for the web tier to be accessible from the internet. It provides a target in the VPC route tables for internet-routable traffic and performs NAT for instances with public IPs. Without an IGW, the public subnet cannot communicate with the internet.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT Gateway alone provides internet access without an IGW, but the NAT Gateway must be placed in a public subnet that has a route to an IGW to function.

Practice this question →

366

Multi-Selectmedium

A company is designing a network for a multi-account AWS environment using AWS Organizations. The company must centralize internet egress for all accounts. Which TWO solutions should the company use? (Choose two.)

Select 2 answers

A.Use VPC Peering to connect all VPCs to the egress VPC.

B.Deploy a AWS Client VPN endpoint in each VPC.

C.Use AWS Transit Gateway to route traffic from all VPCs to the egress VPC.

D.Attach an Internet Gateway to each VPC and allow direct internet access.

E.Create a centralized egress VPC with a NAT Gateway and Internet Gateway.

AnswersC, E

Transit Gateway provides transitive routing.

Why this answer

AWS Transit Gateway acts as a central hub, enabling transitive routing between all attached VPCs. This allows traffic from multiple VPCs to be routed to a centralized egress VPC without requiring complex peering relationships or full mesh connectivity.

Exam trap

AWS often tests the misconception that VPC Peering can be used for transitive routing, but VPC Peering is non-transitive and cannot forward traffic from one peered VPC to another, making Transit Gateway the correct choice for centralized egress.

Practice this question →

367

Multi-Selecthard

A company is designing a hybrid network using AWS Transit Gateway. The company has three VPCs (VPC-A, VPC-B, VPC-C) all attached to the same Transit Gateway. The on-premises network connects to the Transit Gateway via a Direct Connect gateway. The company needs to ensure that VPC-C can communicate with the on-premises network but not with VPC-A or VPC-B. Which TWO actions should the network engineer take?

Select 2 answers

A.Establish a VPN attachment between VPC-C and the Direct Connect gateway.

B.Associate the VPC-C route table with the Direct Connect gateway attachment.

C.Establish VPC peering connections between VPC-C and VPC-A, and VPC-C and VPC-B.

D.Create a separate Transit Gateway route table for VPC-C and do not propagate VPC-A and VPC-B routes.

E.Apply a network ACL on VPC-C subnets to block traffic from VPC-A and VPC-B.

AnswersB, D

Correct: Associating the VPC-C route table with the Direct Connect gateway attachment allows VPC-C to exchange routes with on-premises, enabling communication.

Why this answer

Associating the VPC-C route table with the Direct Connect gateway attachment allows VPC-C to exchange routes with the on-premises network via the Transit Gateway, enabling communication. Option D is correct because creating a separate Transit Gateway route table for VPC-C and not propagating VPC-A and VPC-B routes ensures that VPC-C has no routes to those VPCs, effectively isolating it from them at the network layer. Option A is incorrect because a VPN attachment does not provide connectivity to on-premises via Direct Connect; the Direct Connect gateway attachment is required.

Option C is incorrect because VPC peering enables direct communication between VPCs, which is not desired. Option E is incorrect because network ACLs at the subnet level do not control routing across a Transit Gateway; route table isolation is needed.

Exam trap

The trap here is that candidates often confuse security groups or network ACLs as mechanisms to control inter-VPC traffic across a Transit Gateway, when in fact route table isolation is the correct method to enforce such network segmentation at the transit layer.

Practice this question →

368

MCQhard

An administrator needs to create an interface VPC endpoint for Amazon S3 in a VPC and attach an elastic network interface (ENI) to an EC2 instance. The administrator applies the IAM policy shown in the exhibit. Which action will be DENIED by this policy?

A.Attach the ENI to the EC2 instance

B.Create the VPC endpoint

C.Describe VPC endpoints

D.Modify the VPC endpoint

AnswerB

The policy allows ec2:CreateVpcEndpoint, but the Resource "*" is not sufficient; the action requires the resource to specify the VPC endpoint service ARN. Therefore, this action will be denied.

Why this answer

The IAM policy allows ec2:CreateVpcEndpoint, but the Resource is set to "*" which does not satisfy the resource requirement for this action. The ec2:CreateVpcEndpoint action requires the resource to be the VPC endpoint service (e.g., arn:aws:ec2:region:account-id:vpc-endpoint-service/*). Without a specific resource ARN, the policy does not grant permission to create the endpoint, so the action will be denied.

In contrast, ec2:AttachNetworkInterface, ec2:DescribeVpcEndpoints, and ec2:ModifyVpcEndpoint are allowed by the policy with the wildcard resource.

Practice this question →

369

MCQmedium

A company is deploying a multi-tier web application across multiple AWS accounts. They want to centralize network security by using a shared services VPC with a Transit Gateway. All application VPCs will be attached to the Transit Gateway. The security team needs to inspect and filter traffic between application VPCs. Which solution should be used to meet this requirement?

A.Deploy a Transit Gateway and attach a central inspection VPC with a firewall appliance. Configure route tables to send inter-VPC traffic through the inspection VPC.

B.Create VPC Peering connections between each pair of application VPCs and apply security groups to the peer connections.

C.Use security groups in each application VPC to control traffic between VPCs.

D.Use network ACLs in each application VPC to filter traffic between VPCs.

AnswerA

This architecture allows centralized inspection of all traffic between VPCs by routing it through the inspection VPC.

Why this answer

A Transit Gateway with a central inspection VPC allows you to route all inter-VPC traffic through a firewall appliance for inspection. By configuring route tables on the Transit Gateway, you can force traffic between application VPCs to traverse the inspection VPC, enabling centralized security filtering without requiring point-to-point peering or per-VPC rules.

Exam trap

The ANS-C01 exam often tests the misconception that security groups or network ACLs can filter traffic between VPCs, but they are scoped to a single VPC and cannot inspect traffic traversing a Transit Gateway or VPC Peering connection.

How to eliminate wrong answers

Option B is wrong because VPC Peering connections do not support transitive routing or centralized inspection; each pair must be explicitly peered, and security groups cannot be applied to the peering connection itself—they only apply to resources within a VPC. Option C is wrong because security groups are stateful and operate at the instance level within a single VPC; they cannot filter traffic between VPCs across a Transit Gateway or peering connection. Option D is wrong because network ACLs are stateless and apply only at the subnet level within a single VPC; they cannot filter traffic that traverses a Transit Gateway or VPC Peering connection between different VPCs.

Practice this question →

370

MCQeasy

A company wants to provide its employees with secure access to internal applications hosted in a VPC. The employees work remotely and use personal laptops. The solution must authenticate users against the company's existing identity provider (IdP) and must support both Windows and macOS clients. Which AWS service should be used?

A.AWS Transit Gateway

B.AWS Site-to-Site VPN

C.AWS Direct Connect

D.AWS Client VPN

AnswerD

Correct; AWS Client VPN provides remote access with user authentication.

Why this answer

AWS Client VPN is a fully managed, cloud-based VPN solution that allows remote employees to securely access resources in a VPC using their personal laptops. It supports both Windows and macOS clients natively and can integrate with the company's existing identity provider (IdP) via SAML-based authentication, meeting all stated requirements.

Exam trap

The trap here is that candidates often confuse Site-to-Site VPN (which connects networks) with Client VPN (which connects individual users), leading them to select AWS Site-to-Site VPN despite the requirement for remote employee access from personal laptops.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway is a network transit hub used to interconnect VPCs and on-premises networks, not a remote access VPN service for individual client devices. Option B is wrong because AWS Site-to-Site VPN creates an encrypted tunnel between two networks (e.g., a corporate data center and AWS), not between individual remote clients and the VPC; it does not support client-level authentication against an IdP. Option C is wrong because AWS Direct Connect provides a dedicated physical network connection from on-premises to AWS, which is not suitable for remote employees using personal laptops and does not include built-in client authentication or support for macOS/Windows clients.

Practice this question →

371

Multi-Selecthard

A company is designing a network for a real-time data analytics platform that ingests data from thousands of IoT devices. The devices send data via UDP to a UDP-based collector service running on EC2 instances. The collector service must be highly available and scalable. The data is then processed by a stream processing application. The company wants to minimize latency and jitter. Which TWO architectural choices should they make?

Select 2 answers

A.Use AWS Global Accelerator to provide a static anycast IP address and route traffic to the NLB endpoints

B.Use a Network Load Balancer (NLB) with a UDP listener in front of the collector instances

C.Use an Application Load Balancer (ALB) with a TCP listener and configure the collector to receive TCP

D.Use AWS Global Accelerator with EC2 instances as endpoints directly

E.Deploy an internet-facing NLB with Elastic IP addresses in each Availability Zone

AnswersA, B

Global Accelerator reduces latency by using the AWS global network.

Why this answer

AWS Global Accelerator provides static anycast IP addresses that route traffic over the AWS global network to the optimal NLB endpoint, reducing latency and jitter by avoiding public internet hops and using the AWS backbone. This is ideal for UDP-based real-time analytics where consistent performance is critical.

Exam trap

AWS often tests the misconception that Global Accelerator can directly use EC2 instances as endpoints, but it actually requires an NLB, ALB, or Elastic IP as the endpoint target.

Practice this question →

372

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to peer with another VPC with CIDR 10.0.0.0/16. They plan to use a transit gateway to connect the VPCs. What is the correct approach to handle the overlapping CIDR ranges?

A.Create a new VPC with a non-overlapping CIDR and migrate resources from one of the existing VPCs.

B.Create a VPC peering connection and use a smaller subnet CIDR for traffic filtering.

C.Use a transit gateway with network address translation (NAT) to translate one VPC CIDR to a non-overlapping range.

D.Configure the transit gateway with equal-cost multipath (ECMP) to load balance traffic between the overlapping CIDRs.

AnswerA

This resolves the overlap by eliminating it.

Why this answer

Transit gateways do not perform NAT or resolve overlapping CIDR conflicts between attached VPCs. When two VPCs have identical CIDR blocks (10.0.0.0/16), the transit gateway cannot route traffic correctly because it cannot distinguish between the two networks. The only viable solution is to create a new VPC with a non-overlapping CIDR and migrate resources from one of the existing VPCs, eliminating the conflict at the network layer.

Exam trap

AWS often tests the misconception that a transit gateway can perform NAT or otherwise magically handle overlapping CIDRs, but in reality, AWS transit gateways are pure Layer-3 routers that require unique destination prefixes for correct forwarding.

How to eliminate wrong answers

Option B is wrong because a VPC peering connection also requires non-overlapping CIDRs; using a smaller subnet for filtering does not resolve the fundamental routing conflict, as routes are based on the VPC CIDR, not subnets. Option C is wrong because transit gateways do not provide built-in NAT functionality to translate overlapping CIDRs; any NAT would need to be implemented externally (e.g., via a NAT instance or gateway), and the transit gateway itself cannot perform address translation. Option D is wrong because ECMP is used for load balancing across multiple equal-cost paths, but it cannot resolve the routing ambiguity caused by identical destination CIDRs; the transit gateway would still have no way to differentiate traffic destined for 10.0.0.0/16 in one VPC versus the other.

Practice this question →

373

Multi-Selectmedium

A company is designing a network architecture for a multi-tier web application. The application consists of web servers, application servers, and database servers. The web servers must be accessible from the internet. The application servers should only be accessible from the web servers. The database servers should only be accessible from the application servers. Which TWO actions should the company take to meet these requirements? (Choose two.)

Select 2 answers

A.Use a NAT gateway to allow the web servers to access the internet

B.Use network ACLs to restrict traffic between the tiers

C.Place the web servers in a public subnet and the application and database servers in private subnets

D.Use security groups to restrict traffic between the tiers

E.Place all servers in public subnets and use security groups to restrict traffic

AnswersC, D

Correct; this provides proper isolation.

Why this answer

The correct answers are C and D. Option C: Placing web servers in a public subnet (with an internet gateway) enables internet access, while placing application and database servers in private subnets prevents direct internet access, ensuring they are only reachable from within the VPC. Option D: Security groups act as stateful firewalls at the instance level, allowing fine-grained control over traffic between tiers (e.g., allowing only HTTP from web to app servers, and only database port from app to database servers).

Option A is incorrect because a NAT gateway provides outbound internet access for private instances, not inbound access for web servers. Option B is incorrect because network ACLs are stateless and less granular; while they can restrict traffic between subnets, security groups are the recommended approach for tier-to-tier access control. Option E is incorrect because placing all servers in public subnets exposes application and database servers to the internet unnecessarily, increasing security risk.

Practice this question →

374

MCQeasy

A company wants to provide internet access to instances in a private subnet without using a NAT Gateway, due to cost constraints. They have a public subnet with a bastion host that has a public IP. They also have a VPC with an Internet Gateway. What is the most cost-effective way to allow outbound internet access for instances in the private subnet?

A.Launch a NAT instance in the public subnet and configure the private subnet route table to point 0.0.0.0/0 to the NAT instance.

B.Use a VPN connection to a third-party internet proxy.

C.Create a VPC endpoint for Amazon S3 and configure the private subnet to use it.

D.Configure the bastion host as a NAT instance by enabling IP forwarding.

AnswerA

NAT instance is a cost-effective alternative to NAT Gateway.

Why this answer

Launch a NAT instance in the public subnet and configure the private subnet route table to point 0.0.0.0/0 to the NAT instance. A NAT instance is a cost-effective alternative to NAT Gateway, as it uses an EC2 instance with IP forwarding enabled and can be run on a low-cost instance type. It requires management but avoids NAT Gateway hourly charges.

Option B is incorrect because a VPN connection to a third-party proxy introduces unnecessary complexity and cost. Option C is incorrect because VPC endpoints only provide access to specific AWS services (e.g., S3), not general internet access. Option D is incorrect because the bastion host is typically used for SSH access, and while it could be configured for NAT, it is not recommended for security reasons; a dedicated NAT instance in a public subnet is the proper approach.

Practice this question →

375

MCQmedium

A company is migrating its on-premises data center to AWS. The network team needs to establish connectivity between the on-premises network and multiple VPCs in a single AWS Region. The company has a Direct Connect connection and wants to minimize latency and cost while maximizing bandwidth utilization. Which solution meets these requirements?

A.Provision a separate Direct Connect virtual interface for each VPC.

B.Create a VPN connection over the Direct Connect link to each VPC.

C.Use VPC peering between the on-premises network and each VPC.

D.Use a Direct Connect gateway and associate it with the VPCs.

AnswerD

A Direct Connect gateway allows multiple VPCs to share the same Direct Connect connection.

Why this answer

A Direct Connect gateway allows a single Direct Connect connection to connect to multiple VPCs in the same or different AWS Regions, minimizing latency by using a private, dedicated network path and reducing cost by eliminating the need for separate virtual interfaces or VPN tunnels per VPC. It also maximizes bandwidth utilization by aggregating traffic from multiple VPCs over the same Direct Connect link.

Exam trap

AWS often tests the misconception that VPC peering can be used for on-premises connectivity, but VPC peering only works between VPCs and does not support VPN or Direct Connect attachments from on-premises networks.

How to eliminate wrong answers

Option A is wrong because provisioning a separate Direct Connect virtual interface for each VPC would require multiple VLANs and increase operational complexity and cost, and each virtual interface has a bandwidth limit that may not be fully utilized, leading to inefficient bandwidth usage. Option B is wrong because creating a VPN connection over the Direct Connect link adds unnecessary encryption overhead and latency, and each VPN tunnel consumes bandwidth and requires separate configuration, increasing cost and reducing efficiency. Option C is wrong because VPC peering is designed for connectivity between VPCs within AWS, not for connecting an on-premises network to VPCs; it does not support on-premises endpoints and would require additional VPN or Direct Connect attachments to function.

Practice this question →