Knowledge + Practice

CCNA Network Implementation Questions

75 of 416 questions · Page 1/6 · Network Implementation topic · Answers revealed

Practice these questions Exam hub All questions

1

MCQeasy

A company wants to securely connect multiple VPCs in the same region to a common on-premises network using a single Direct Connect connection. Which AWS service should they use to simplify the network architecture?

A.Virtual Private Gateway

B.Direct Connect Gateway

C.VPC Peering

D.Transit Gateway

AnswerB

Direct Connect Gateway enables multiple VPCs to use a single Direct Connect connection.

Why this answer

A Direct Connect Gateway allows you to associate multiple VPCs (in the same or different AWS regions) with a single AWS Direct Connect connection, enabling connectivity to a common on-premises network. This simplifies the architecture by eliminating the need for multiple virtual interfaces or separate Direct Connect connections per VPC. The Direct Connect Gateway acts as a hub that routes traffic between the on-premises network and all associated VPCs via a single private virtual interface (VIF).

Exam trap

The trap here is that candidates often confuse Transit Gateway with Direct Connect Gateway, assuming Transit Gateway alone can aggregate multiple VPCs under a single Direct Connect connection, but Transit Gateway requires a Direct Connect Gateway to terminate the Direct Connect virtual interface, making Direct Connect Gateway the correct answer for simplifying the architecture with a single connection.

How to eliminate wrong answers

Option A is wrong because a Virtual Private Gateway (VGW) is a per-VPC attachment point for VPN or Direct Connect; it cannot be shared across multiple VPCs, so using it would require separate Direct Connect connections or complex routing. Option C is wrong because VPC Peering provides direct connectivity between two VPCs but does not extend to on-premises networks, nor does it support a single Direct Connect connection to multiple VPCs. Option D is wrong because Transit Gateway is a network transit hub that can connect VPCs and on-premises networks, but it does not natively aggregate multiple VPCs under a single Direct Connect connection; you would still need a Direct Connect Gateway to attach the Direct Connect virtual interface to the Transit Gateway, making it an additional component rather than the simplifying service.

Practice this question →

2

MCQmedium

A company is implementing a hybrid network with AWS Direct Connect and a VPN connection as backup. They have a Direct Connect gateway (DXGW) attached to a private VIF and a virtual private gateway (VGW) attached to a VPN connection. The VPC is attached to the VGW. They want to use the Direct Connect connection for all traffic when available. The on-premises router advertises the same prefix over both connections. However, traffic from on-premises to the VPC is using the VPN connection. BGP is configured correctly on both connections. What should the company do to prefer the Direct Connect path?

A.Set a higher weight on the Direct Connect BGP session.

B.Set a higher local preference on the Direct Connect VIF.

C.Change the BGP timers on the Direct Connect VIF to have a lower hold time.

D.Configure AS_PATH prepending on the VPN BGP session.

E.Configure a lower MED (Multi-Exit Discriminator) on the Direct Connect VIF.

AnswerE

Lower MED is preferred for inbound traffic; setting a lower MED on the Direct Connect VIF will make it the preferred path.

Why this answer

The Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic from an AS to the local AS. By setting a lower MED on the Direct Connect VIF, the on-premises router will prefer the Direct Connect path over the VPN path when both advertise the same prefix, assuming all other BGP path selection criteria are equal. This directly addresses the requirement to prefer the Direct Connect connection for all traffic.

Exam trap

The trap here is that candidates often confuse BGP attributes that influence outbound traffic (weight, local preference) with those that influence inbound traffic (MED), leading them to incorrectly select options A or B instead of the correct MED-based solution.

How to eliminate wrong answers

Option A is wrong because weight is a Cisco-proprietary attribute that influences outbound traffic from the local router, not inbound traffic from on-premises; it is not applicable to the on-premises router's path selection. Option B is wrong because local preference is used to influence outbound traffic from an AS to external destinations, not inbound traffic from on-premises to the VPC. Option C is wrong because changing BGP timers (e.g., hold time) affects convergence speed and failure detection, not path preference; it does not influence which path is chosen for traffic.

Option D is wrong because AS_PATH prepending on the VPN BGP session would make the VPN path appear longer (less preferred), which would actually help prefer Direct Connect, but the question asks for a configuration on the Direct Connect side; moreover, AS_PATH prepending is typically applied to the less preferred path, not the preferred one, and the correct approach is to set a lower MED on the Direct Connect VIF.

Practice this question →

3

Multi-Selectmedium

A network engineer is troubleshooting connectivity between an on-premises data center and a VPC over an AWS Site-to-Site VPN. The tunnel status shows UP, but traffic from on-premises to the VPC is intermittently dropped. Which TWO of the following are likely causes? (Choose 2.)

Select 2 answers

A.Dead Peer Detection (DPD) timeout configuration

B.BGP hold timer expiration

C.Asymmetric routing across multiple tunnels

D.Incorrect MTU size causing packet fragmentation

E.IPsec SA lifetime mismatch between peers

AnswersC, D

Asymmetric routing can cause stateful devices to drop packets.

Why this answer

Asymmetric routing across multiple tunnels can cause intermittent drops because traffic from on-premises to the VPC may take one tunnel, while return traffic takes a different tunnel. If the stateful firewall (e.g., security groups, network ACLs, or on-premises firewall) sees packets from a different source IP or interface than expected, it may drop the return packets, leading to connectivity issues even though both tunnels are UP.

Exam trap

The trap here is that candidates often focus on tunnel status (UP) and assume the issue must be related to IPsec parameters or BGP timers, overlooking the subtle but common problem of asymmetric routing causing stateful firewall drops.

Practice this question →

4

MCQmedium

A company is deploying a multi-tier web application across three Availability Zones in a VPC. The web tier must be highly available and scale based on CPU utilization. The database tier uses an Amazon RDS Multi-AZ DB instance. The web tier must have the lowest possible latency to the internet. Which configuration should be used for the web tier subnets?

A.Place the web tier in public subnets with auto-assign public IP addresses disabled.

B.Place the web tier in public subnets with auto-assign public IP addresses enabled.

C.Place the web tier in private subnets and use a VPC endpoint for internet access.

D.Place the web tier in private subnets and use a NAT gateway for internet access.

AnswerB

Public subnets provide direct internet access with lowest latency.

Why this answer

Placing the web tier in public subnets with auto-assign public IP addresses enabled ensures that each EC2 instance receives a public IPv4 address automatically, allowing direct internet access for low-latency communication. Public subnets have a route to an internet gateway, which provides the shortest path to the internet without additional hops. This configuration supports high availability across three Availability Zones and integrates with an Auto Scaling group based on CPU utilization.

Exam trap

The ANS-C01 exam often tests the misconception that private subnets with a NAT gateway provide lower latency than public subnets with an internet gateway, but the trap here is that NAT gateways introduce additional network hops and are unsuitable for inbound web traffic, making public subnets the correct choice for lowest latency internet-facing web tiers.

How to eliminate wrong answers

Option A is wrong because disabling auto-assign public IP addresses in public subnets would require manual assignment of Elastic IPs or additional configuration, adding complexity and potential latency; the instances would still have a route to the internet gateway but lack a public IP for direct outbound connectivity. Option C is wrong because VPC endpoints are used for private connectivity to AWS services (e.g., S3, DynamoDB), not for general internet access; they do not provide a path to the public internet. Option D is wrong because using a NAT gateway in private subnets introduces an extra hop, increasing latency compared to direct internet access via an internet gateway, and NAT gateways are not designed for inbound traffic from the internet, which is required for a web tier serving user requests.

Practice this question →

5

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16. They create a subnet 10.0.1.0/24 and launch an EC2 instance with a private IP 10.0.1.5. The instance needs to communicate with an on-premises server at 172.16.0.10 over a VPN connection. The VPN connection uses a Virtual Private Gateway. The VPC route table has a route 172.16.0.0/16 pointing to the VPG. The instance cannot reach the on-premises server. What is the most likely cause?

A.The security group attached to the instance does not allow outbound traffic to 172.16.0.10.

B.The instance's route table does not have a route to the internet gateway.

C.The network ACL for the subnet denies outbound traffic to the on-premises IP range.

D.The on-premises router is not advertising the 172.16.0.0/16 route to the Virtual Private Gateway.

AnswerD

Without the route advertisement, the VPG does not know how to reach the on-premises network.

Why this answer

The VPN connection requires the on-premises router to advertise the 172.16.0.0/16 route to the Virtual Private Gateway (VPG) via BGP (or static route configuration) for the VPG to forward traffic to the on-premises network. Without this route advertisement, the VPG will not have a path to 172.16.0.10, even though the VPC route table has a route pointing to the VPG. The instance's traffic reaches the VPG, but the VPG cannot forward it because it lacks the necessary routing information from the on-premises side.

Exam trap

The trap here is that candidates often assume that adding a route in the VPC route table pointing to the VPG is sufficient for connectivity, overlooking the requirement that the on-premises router must also advertise the destination network to the VPG via BGP or have a static route configured.

How to eliminate wrong answers

Option A is wrong because security groups are stateful; if outbound traffic is allowed (which it is by default for all traffic unless explicitly denied), the corresponding return traffic is automatically permitted, and the issue is about reachability, not a missing outbound rule. Option B is wrong because the instance does not need an internet gateway route to communicate with an on-premises server over a VPN; the route to the on-premises network points to the Virtual Private Gateway, not an internet gateway. Option C is wrong because network ACLs are stateless and must explicitly allow both outbound and inbound traffic; however, the default network ACL allows all outbound traffic, and the question does not indicate any custom ACL modification that would deny traffic to 172.16.0.0/16.

Practice this question →

6

MCQmedium

A company has multiple VPCs that need to communicate with each other. They want to use a hub-and-spoke model with centralized network management. Which AWS service should they use?

A.AWS Direct Connect

B.VPN CloudHub

C.VPC Peering

D.AWS Transit Gateway

AnswerD

Transit Gateway enables a hub-and-spoke topology with centralized routing.

Why this answer

AWS Transit Gateway (D) is the correct choice because it acts as a central hub that interconnects multiple VPCs and on-premises networks using a hub-and-spoke topology. It simplifies network management by providing a single point of connectivity and supports transitive routing between all attached VPCs, which is exactly what the company needs for centralized network management.

Exam trap

The trap here is that candidates often confuse VPC Peering (C) as the default solution for VPC connectivity, but they overlook its lack of transitive routing and the management overhead of creating a full mesh, which makes Transit Gateway the only correct choice for a hub-and-spoke model with centralized management.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not a service for interconnecting multiple VPCs in a hub-and-spoke model. Option B is wrong because VPN CloudHub is designed to connect multiple on-premises sites via VPN tunnels to a single AWS VPN endpoint, but it does not provide transitive routing between VPCs or centralized VPC management. Option C is wrong because VPC Peering creates a one-to-one, non-transitive connection between two VPCs; to interconnect multiple VPCs, you would need a full mesh of peering connections, which is complex and does not scale well, unlike the hub-and-spoke model required.

Practice this question →

7

MCQmedium

A company deployed an Application Load Balancer (ALB) in front of a fleet of EC2 instances. Users report intermittent timeouts. The ALB's target group health checks are failing for some instances. The instances are in private subnets with a single NAT Gateway. What is the most likely cause?

A.The security group on the EC2 instances does not allow inbound traffic from the ALB's security group.

B.The route tables in the private subnets do not have a default route pointing to the NAT Gateway.

C.The EC2 instances are of an unsupported instance type for ALB target groups.

D.The NAT Gateway is in a single Availability Zone, causing traffic to fail during an AZ outage.

AnswerA

ALB health checks originate from the ALB's security group; if not allowed, health checks fail.

Why this answer

The most likely cause is that the security group on the EC2 instances does not allow inbound traffic from the ALB's security group. ALB health checks originate from the ALB's private IP addresses, and if the instance security group lacks an inbound rule permitting traffic from the ALB's security group (or its CIDR) on the health check port, the health checks will fail, causing intermittent timeouts as the ALB stops routing traffic to unhealthy targets.

Exam trap

The ANS-C01 exam often tests the misconception that NAT Gateway configuration affects internal VPC traffic, leading candidates to incorrectly select route table or NAT Gateway issues when the actual problem is security group misconfiguration for ALB health checks.

How to eliminate wrong answers

Option B is wrong because route tables in private subnets lacking a default route to the NAT Gateway would prevent outbound internet traffic from the instances, but health checks and traffic from the ALB to the instances occur within the VPC and do not require a NAT Gateway. Option C is wrong because ALB target groups support all current-generation EC2 instance types, and there is no restriction on instance type for ALB targets. Option D is wrong because while a single-AZ NAT Gateway can cause internet connectivity issues during an AZ outage, health checks and traffic between the ALB and instances are internal to the VPC and do not depend on the NAT Gateway; the NAT Gateway is only used for outbound internet access from private instances.

Practice this question →

8

MCQhard

A network engineer is troubleshooting connectivity issues between an on-premises network and a VPC over a Direct Connect private VIF. The on-premises network can reach EC2 instances in the VPC, but cannot reach an RDS database in the same VPC. The VPC has a single subnet. What is the MOST likely cause?

A.The VPC network ACL is blocking inbound traffic from on-premises

B.The direct connect virtual interface is configured for a different VLAN

C.The RDS database security group is not allowing inbound traffic from the on-premises CIDR

D.The VPC route table does not have a route to the on-premises network

AnswerC

Security groups are stateful and often the cause of such issues.

Why this answer

Since the on-premises network can reach EC2 instances but not the RDS database, the issue is likely at the security group level, not the network ACL or routing. Security groups are stateful and act as a virtual firewall for instances; by default, they deny all inbound traffic unless explicitly allowed. The RDS database's security group must have an inbound rule permitting traffic from the on-premises CIDR range, and its absence would block the connection while leaving EC2 access unaffected.

Exam trap

The ANS-C01 exam often tests the distinction between security groups and network ACLs, and the trap here is that candidates assume a subnet-level ACL (Option A) is the cause when the symptom is specific to one resource type, overlooking that security groups operate at the instance level and can selectively block traffic.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and apply at the subnet level; if the NACL were blocking inbound traffic from on-premises, it would also block access to EC2 instances in the same subnet, which is not the case. Option B is wrong because a VLAN mismatch on the Direct Connect virtual interface would prevent any Layer 2 connectivity, making it impossible for on-premises to reach any resources in the VPC, including EC2. Option D is wrong because the VPC route table does not need a route to the on-premises network for inbound traffic; the on-premises router must have a route to the VPC CIDR, and the VPC route table only needs a route for return traffic (e.g., a static route via the virtual private gateway), which is already working since EC2 instances are reachable.

Practice this question →

9

Multi-Selectmedium

A company is designing a highly available network architecture using AWS Direct Connect. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to ensure that if one connection fails, traffic automatically fails over to the other. Which TWO steps should they take? (Select TWO.)

Select 2 answers

A.Advertise the same prefix over both Direct Connect connections.

B.Use a different BGP AS number for each Direct Connect connection.

C.Use static routes instead of BGP for the Direct Connect connections.

D.Enable Bidirectional Forwarding Detection (BFD) on both BGP sessions.

E.Configure a single virtual interface for both connections.

AnswersA, D

Same prefix allows BGP to select the best path and fail over automatically.

Why this answer

Advertising the same prefix over both Direct Connect connections allows BGP to provide automatic failover. When one connection fails, BGP withdraws the route for that prefix, and traffic is redirected to the remaining connection. This leverages BGP's path selection and route propagation to achieve active/backup or active/active redundancy without manual intervention.

Exam trap

The trap here is that candidates often think static routes are simpler and sufficient for failover, but they lack dynamic failure detection and route withdrawal, making BGP mandatory for automatic failover in Direct Connect architectures.

Practice this question →

10

MCQhard

A company has multiple AWS accounts and wants to centrally manage network security using AWS Network Firewall. The firewall must inspect traffic between VPCs in the same Region. Which deployment model achieves this with minimal latency?

A.Deploy AWS Network Firewall in each VPC and configure VPC peering between VPCs.

B.Deploy AWS Network Firewall in a shared services VPC and use VPC peering to connect all VPCs.

C.Use AWS Transit Gateway and attach AWS Network Firewall as a VPC attachment to the transit gateway.

D.Use a centralized inspection VPC with a Gateway Load Balancer and third-party appliances.

AnswerC

This centralizes inspection and routes traffic through the firewall with minimal latency.

Why this answer

AWS Transit Gateway enables a hub-and-spoke architecture where all VPCs route traffic through a central inspection VPC. By attaching AWS Network Firewall as a VPC attachment to the transit gateway, traffic between VPCs is routed through the firewall for inspection with minimal latency because the firewall is deployed inline within the transit gateway route table, avoiding the overhead of multiple peering connections or third-party appliances.

Exam trap

The trap here is that candidates often confuse VPC peering with transitive routing, assuming that connecting all VPCs to a central VPC via peering allows traffic to flow through the firewall, but VPC peering does not support transitive routing, so traffic between two spoke VPCs would not be inspected unless explicitly routed through the central VPC, which is not natively supported.

How to eliminate wrong answers

Option A is wrong because deploying AWS Network Firewall in each VPC and using VPC peering creates a mesh of point-to-point connections, which does not provide centralized inspection; traffic between peered VPCs bypasses the firewall unless complex routing is manually configured, and it introduces higher latency due to multiple hops. Option B is wrong because VPC peering does not support transitive routing; connecting all VPCs to a shared services VPC via peering still requires each VPC to have explicit routes to the firewall, and traffic between two spoke VPCs cannot be inspected unless it goes through the shared VPC, which is not natively supported by VPC peering without additional NAT or proxy instances. Option D is wrong because using a Gateway Load Balancer with third-party appliances introduces additional latency and complexity compared to AWS Network Firewall, which is a managed service designed for high-throughput, low-latency inspection; the question specifically asks for minimal latency, and AWS Network Firewall integrated with Transit Gateway provides lower latency than third-party appliances behind a GWLB.

Practice this question →

11

MCQeasy

A company has a VPC with a CIDR of 10.0.0.0/16. They have an Application Load Balancer (ALB) in public subnets and EC2 instances in private subnets. The ALB is configured to route traffic to the instances. Users can reach the ALB, but the ALB returns 502 Bad Gateway errors. The target group health checks are failing. The instances are running a web server on port 80. The security group for the instances allows inbound traffic from the ALB's security group on port 80. The network ACL for the private subnets allows inbound traffic on port 80 from the public subnet CIDR (10.0.1.0/24). What is the most likely cause of the health check failures?

A.The network ACL for the private subnets does not allow inbound traffic on port 80 from the ALB's subnet

B.The security group for the instances does not allow inbound traffic from the ALB

C.The network ACL for the private subnets is stateless and is blocking the return traffic from the instances to the ALB

D.The target group is configured with the wrong port

AnswerC

NACLs are stateless; outbound traffic from the private subnet to the ALB must be explicitly allowed.

Why this answer

The most likely cause is that the network ACL for the private subnets is stateless. While the inbound rule allows traffic on port 80 from the public subnet CIDR (which includes the ALB's IPs), the outbound rule does not allow the return traffic from the instances to the ALB. This return traffic uses ephemeral ports and must be explicitly allowed in the outbound rules of the private subnet NACL.

Without this, the ALB cannot receive responses from the instances, causing health checks to fail and resulting in 502 errors. Option A is incorrect because the inbound NACL rule does allow traffic from the ALB's subnet. Option B is incorrect because the security group allows inbound traffic from the ALB's security group.

Option D is incorrect because the target group port is correctly set to 80.

Practice this question →

12

MCQhard

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The VPC has a virtual private gateway (VGW). The on-premises network uses BGP to advertise routes. The company wants to ensure high availability by using two Direct Connect connections from different providers. Both connections terminate at the same Direct Connect location (same AWS device). The company configures two private VIFs, each with a separate BGP session, and attaches both to the same VGW. However, when one connection fails, traffic does not fail over. What is the most likely cause?

A.Both Direct Connect connections are on the same AWS device, creating a single point of failure

B.The same BGP ASN is used for both VIFs, causing route conflict

C.The MTU size is mismatched between the VIFs

D.The allowed prefixes for the VIFs do not include the on-premises subnets

AnswerA

Same location and device means no redundancy.

Why this answer

If both connections terminate at the same AWS Direct Connect location and same device, they share the same physical infrastructure. A failure at that location would affect both. True high availability requires connections at different locations.

Also, BGP configuration may not have proper failover. The most likely cause is that both VIFs are on the same device, so a single point of failure exists. Option B (BGP ASN) is wrong because same ASN is allowed.

Option C (allowed prefixes) would cause routes not to be accepted. Option D (MTU) would not cause complete failover failure.

Practice this question →

13

MCQhard

A company has deployed a Network Load Balancer (NLB) in a VPC. The NLB is configured with a target group that points to EC2 instances in the same VPC. The network engineer notices that traffic from clients is not being forwarded to the targets. The NLB's security groups and network ACLs allow all traffic. What is the most likely cause?

A.The security group attached to the NLB is blocking traffic.

B.The EC2 instances are missing a route back to the NLB's subnet.

C.The NLB health checks are failing, causing targets to be marked unhealthy.

D.Cross-zone load balancing is disabled on the NLB.

AnswerB

Preserve client IP is enabled, so targets must send response back to NLB; if they have a default route to NAT gateway, return traffic goes to internet.

Why this answer

When an NLB forwards traffic to targets, the targets must send response traffic back to the clients. If the EC2 instances lack a route to the NLB's subnet (or the client's IP via the NLB), the return traffic will be dropped, causing the connection to fail. Since the NLB operates at layer 4 and preserves the client IP, the targets need a route back to the client, often via the NLB's private IP or the VPC's default gateway, depending on the architecture.

Exam trap

The ANS-C01 exam often tests the misconception that NLB health checks are the primary cause of traffic not being forwarded, but the real trap here is that candidates overlook the asymmetric routing issue where targets cannot send return traffic back through the NLB due to missing routes.

How to eliminate wrong answers

Option A is wrong because the question explicitly states that the NLB's security groups allow all traffic, and NLBs do not have security groups — they use security groups only for the targets, but the scenario says the NLB's security groups (if they existed) allow all traffic, so this is not the issue. Option C is wrong because while health check failures can cause targets to be marked unhealthy, the question states that traffic is not being forwarded at all, and health checks would only affect which targets receive traffic, not the fundamental routing of return packets. Option D is wrong because cross-zone load balancing affects distribution of traffic across availability zones, not the basic connectivity or routing between the NLB and its targets.

Practice this question →

14

MCQmedium

A company has a VPC with CIDR 10.0.0.0/16 and needs to connect to another VPC (192.168.0.0/16) using VPC peering. Both VPCs have overlapping CIDRs with some on-premises networks. What must be done to ensure proper routing?

A.Use AWS Transit Gateway instead and attach both VPCs.

B.Verify that the CIDR blocks do not overlap. If they do, you must re-IP one VPC or use other solutions like Transit Gateway with network address translation.

C.Use a NAT gateway in one VPC to translate addresses.

D.Create the peering connection and add routes for the full CIDR ranges in both route tables.

AnswerB

Without overlap, peering works. Overlap requires re-IP or alternative solutions.

Why this answer

VPC peering requires non-overlapping CIDR blocks because AWS uses the destination CIDR to route traffic; if the CIDRs overlap, the route tables cannot distinguish between the two VPCs, causing asymmetric routing or dropped traffic. Option B correctly identifies that overlapping CIDRs must be resolved, either by re-IPing one VPC or using Transit Gateway with NAT capabilities to translate addresses and avoid conflicts.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering can handle overlapping CIDRs by simply adding routes, but the trap is that AWS route tables require unique destination CIDRs for each next-hop, and overlapping ranges cause routing conflicts that break connectivity.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway does not inherently resolve overlapping CIDRs; it requires additional NAT or segmentation (e.g., separate TGW attachments with route table isolation) to handle overlaps, and simply using Transit Gateway without address translation would still cause routing conflicts. Option C is wrong because a NAT gateway translates private IPs to a different public or private IP range, but it is designed for outbound internet traffic from a single VPC, not for bidirectional inter-VPC routing with overlapping CIDRs; it would break return traffic and is not a supported solution for VPC peering overlaps. Option D is wrong because creating a peering connection and adding routes for the full CIDR ranges will cause routing ambiguity when the CIDRs overlap; the VPC route table cannot differentiate between the local VPC's 10.0.0.0/16 and the peered VPC's 192.168.0.0/16 if they overlap with on-premises networks, leading to unpredictable traffic flow.

Practice this question →

15

MCQmedium

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via Direct Connect and Site-to-Site VPN. The network team wants to ensure that traffic between VPCs does not traverse the on-premises network. Which Transit Gateway feature should be used?

A.Transit Gateway Multicast

B.Transit Gateway Network Manager

C.Transit Gateway BGP over AWS Direct Connect

D.Transit Gateway route tables with separate associations and propagations

AnswerD

This allows creating isolated routing domains.

Why this answer

Transit Gateway route tables with separate associations and propagations allow you to isolate traffic between VPCs and on-premises networks. By associating VPC attachments to one route table and on-premises attachments (Direct Connect, VPN) to another, you can prevent VPC-to-VPC traffic from being routed through the on-premises network. This ensures that inter-VPC traffic stays within AWS, meeting the requirement.

Exam trap

The trap here is that candidates confuse routing protocol features (like BGP) or management tools (like Network Manager) with the actual routing isolation mechanism, assuming they control traffic paths, when in fact Transit Gateway route tables with separate associations and propagations are the correct solution.

How to eliminate wrong answers

Option A is wrong because Transit Gateway Multicast is used for one-to-many multicast traffic distribution, not for controlling routing paths between VPCs and on-premises networks. Option B is wrong because Transit Gateway Network Manager is a monitoring and visualization tool for network topology and health, not a routing control feature. Option C is wrong because BGP over AWS Direct Connect is a protocol for exchanging routing information between on-premises and AWS, but it does not isolate VPC-to-VPC traffic from traversing the on-premises network; route table segmentation is required.

Practice this question →

16

MCQhard

A company is designing a multi-region architecture with two AWS Regions. They need to connect VPCs in each region to an on-premises data center using AWS Direct Connect. They want to minimize latency and use the same BGP ASN on both sides. Which solution meets these requirements?

A.Use a Direct Connect gateway and create a private virtual interface from each region's Direct Connect connection to the Direct Connect gateway. Use the same BGP ASN on AWS side.

B.Establish two separate private virtual interfaces from each region to the on-premises router using different BGP ASNs.

C.Use AWS Site-to-Site VPN over the internet as a backup and the Direct Connect as primary.

D.Create a transit virtual interface from each region to a Transit Gateway in each region and peer the Transit Gateways.

AnswerA

Direct Connect gateway allows same ASN across multiple VIFs and regions.

Why this answer

A Direct Connect gateway allows you to associate private virtual interfaces from multiple regions, enabling a single BGP ASN to be used on the AWS side across all connections. This minimizes latency by providing direct, private connectivity from each region to the on-premises data center without traversing the public internet. The ability to use the same BGP ASN on both sides is supported because the Direct Connect gateway presents itself as a single BGP speaker, avoiding ASN conflicts.

Exam trap

The trap here is that candidates often assume a transit virtual interface or Transit Gateway peering is required for multi-region connectivity, but the Direct Connect gateway is specifically designed to aggregate private virtual interfaces from multiple regions while allowing the same BGP ASN on both sides.

How to eliminate wrong answers

Option B is wrong because it requires using different BGP ASNs on the AWS side, which contradicts the requirement to use the same BGP ASN on both sides. Option C is wrong because it introduces a VPN backup over the internet, which does not address the requirement to minimize latency or use the same BGP ASN; it also adds complexity and potential latency. Option D is wrong because a transit virtual interface is used to connect a Direct Connect connection to a Transit Gateway, not to a Direct Connect gateway, and peering Transit Gateways across regions does not inherently allow the same BGP ASN to be used on both sides; it also adds unnecessary transit hops that can increase latency.

Practice this question →

17

MCQmedium

A company is connecting their on-premises data center to AWS using a site-to-site VPN. The customer gateway device has a dynamic routing configuration with BGP. The VPN connection is established, but the VPC route table does not contain the on-premises network routes. What is the most likely cause?

A.The customer gateway device is not configured with the correct BGP ASN.

B.The VPC route table has static routes pointing to the virtual private gateway.

C.Route propagation is not enabled on the VPC route table.

D.The VPN connection is using static routing instead of dynamic routing.

AnswerC

Route propagation must be enabled for dynamic BGP routes to be added.

Why this answer

When using a site-to-site VPN with dynamic routing (BGP), the VPC route table must have route propagation enabled to automatically import the BGP-advertised routes from the virtual private gateway (VGW). Without route propagation, the VPC route table will not contain the on-premises network routes, even though the VPN tunnel and BGP session are established.

Exam trap

The trap here is that candidates often assume that if the VPN tunnel and BGP session are up, the routes will automatically appear in the VPC route table, overlooking the explicit requirement to enable route propagation on the VPC route table.

How to eliminate wrong answers

Option A is wrong because an incorrect BGP ASN on the customer gateway device would prevent the BGP session from establishing, not just the routes from appearing in the VPC route table; the question states the VPN connection is established, so BGP peering is working. Option B is wrong because static routes pointing to the virtual private gateway would not prevent dynamic routes from being propagated; they would coexist, but the issue is that no routes appear at all, which points to propagation being disabled. Option D is wrong because the question explicitly states the customer gateway device has a dynamic routing configuration with BGP, so the VPN connection is using dynamic routing, not static routing.

Practice this question →

18

MCQhard

A company is deploying a multi-region application with an Application Load Balancer (ALB) in us-east-1 and a second ALB in eu-west-1. They want to route traffic to the nearest region using Amazon Route 53. They have set up a latency-based routing policy. Users in North America are being routed to eu-west-1 instead of us-east-1. What is the most likely cause?

A.The routing policy is incorrectly configured as geolocation instead of latency

B.The us-east-1 ALB is not associated with a Route 53 record set

C.The health checks for the us-east-1 ALB are failing

D.Latency measurements between the user and us-east-1 are higher than expected due to transient network conditions

AnswerD

Latency-based routing uses measured latency; higher latency can cause routing to other region.

Why this answer

Latency-based routing in Route 53 selects the region with the lowest measured latency for the user. If transient network conditions cause higher-than-normal latency between the user and us-east-1, Route 53 may route traffic to eu-west-1 despite the geographic proximity. This is the most likely cause because the question states the routing policy is already set to latency, and transient conditions can skew measurements.

Exam trap

The trap here is that candidates may assume latency-based routing always routes to the geographically closest region, but it actually routes based on measured network latency, which can be affected by transient conditions, not just physical distance.

How to eliminate wrong answers

Option A is wrong because the question explicitly states they have set up a latency-based routing policy, so it is not incorrectly configured as geolocation. Option B is wrong because if the us-east-1 ALB were not associated with a Route 53 record set, the record would not exist for that region, and traffic would not be routed to eu-west-1 for users in North America; instead, the query might fail or return no answer. Option C is wrong because failing health checks would cause Route 53 to exclude the us-east-1 endpoint from the latency evaluation, making eu-west-1 the only available option, but the question implies both ALBs are healthy and the issue is routing preference, not unavailability.

Practice this question →

19

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network is advertising a default route (0.0.0.0/0) over BGP. The VPC has an internet gateway attached. When an EC2 instance in the VPC sends traffic to an internet destination, which path does it take by default?

A.Traffic goes to the on-premises network only if there is a static route.

B.Traffic is dropped because there is no route.

C.Traffic goes to the internet via the internet gateway.

D.Traffic goes to the on-premises network via Direct Connect.

AnswerD

The propagated BGP route is more specific than a default route to IGW, if any.

Why this answer

When an on-premises network advertises a default route (0.0.0.0/0) over BGP via a Direct Connect private VIF, that route is propagated into the VPC route tables as a static route. By default, the most specific route (longest prefix match) is preferred, but since both the internet gateway and the BGP-advertised route are for 0.0.0.0/0, the BGP route takes precedence because it is learned via a more specific path (Direct Connect) and is considered a static route in the VPC route table, overriding the internet gateway's implicit route.

Exam trap

The ANS-C01 exam often tests the misconception that an internet gateway always takes precedence for internet-bound traffic, but the trap here is that a BGP-advertised default route via Direct Connect is treated as a static route in the VPC, overriding the internet gateway's implicit route for the same destination.

How to eliminate wrong answers

Option A is wrong because a static route is not required; the BGP-advertised default route is automatically installed in the VPC route table and takes effect without manual static configuration. Option B is wrong because traffic is not dropped; there is a valid route via Direct Connect to the on-premises network, which then forwards traffic to the internet. Option C is wrong because the internet gateway route for 0.0.0.0/0 is overridden by the more specific BGP-learned route from Direct Connect, so traffic does not go directly to the internet gateway.

Practice this question →

20

MCQeasy

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets host NAT gateways for outbound internet access from the private subnets. Which configuration ensures that EC2 instances in the private subnets can route traffic to the internet through the NAT gateways?

A.Add a route in the public subnet route table pointing to the internet gateway.

B.Attach an egress-only internet gateway to the private subnets.

C.Create a VPC peering connection between the VPC and the NAT gateway.

D.Add a route in the private subnet route table with destination 0.0.0.0/0 targeting the NAT gateway.

AnswerD

This enables outbound internet access from private instances via NAT.

Why this answer

For EC2 instances in private subnets to reach the internet via a NAT gateway, the private subnet route table must include a default route (0.0.0.0/0) pointing to the NAT gateway as the next hop. The NAT gateway resides in a public subnet and translates the private IPs to its own Elastic IP, forwarding traffic to the internet gateway. Without this route, traffic from private instances has no path to the NAT gateway.

Exam trap

The trap here is that candidates often confuse the direction of routing and think a route in the public subnet (Option A) or an egress-only gateway (Option B) can serve private IPv4 traffic, when in fact the private subnet must explicitly route to the NAT gateway.

How to eliminate wrong answers

Option A is wrong because adding a route in the public subnet route table pointing to the internet gateway only affects traffic originating from the public subnet itself, not from private subnets; private subnet traffic must be directed to the NAT gateway, not directly to the internet gateway. Option B is wrong because an egress-only internet gateway is used for IPv6 traffic only, not for IPv4 traffic, and the question implies IPv4 (0.0.0.0/0). Option C is wrong because a VPC peering connection is used to connect two VPCs, not to connect a subnet to a NAT gateway; the NAT gateway is already within the same VPC and does not require peering.

Practice this question →

21

MCQmedium

A company is deploying a multi-tier web application across two AWS Regions. The application uses an Application Load Balancer (ALB) in each region, and traffic must be distributed to the closest healthy ALB using Route 53 latency-based routing. The application requires that clients maintain the same source IP address when the request is forwarded from the ALB to the backend targets. The backend targets are EC2 instances in private subnets. The company also needs to ensure that traffic between the ALB and targets stays within AWS. What should the company implement to meet these requirements?

A.Deploy a Network Load Balancer (NLB) in each region with targets in private subnets. Use Route 53 latency-based routing to the NLB.

B.Deploy an internal ALB in each region. Place targets in private subnets. Use VPC endpoints for the ALB (AWS PrivateLink) and Route 53 latency-based routing to the VPC endpoint.

C.Deploy an Application Load Balancer (ALB) with internet-facing scheme in each region. Use Route 53 latency-based routing to the ALB.

D.Use AWS Global Accelerator with endpoints in each region. Attach the ALB as an endpoint and enable client IP preservation on the accelerator.

E.Deploy an ALB with internet-facing scheme in each region. Use Route 53 latency-based routing to the ALB. Place targets in public subnets to preserve source IP.

AnswerA

Correct: NLB preserves source IP, targets in public subnets stay within VPC, and Route 53 latency routing can point to NLB's DNS name.

Why this answer

Network Load Balancer (NLB) preserves the client source IP by default, meeting the requirement for source IP preservation. Targets must be placed in private subnets as per the given requirements, and traffic between the NLB and targets remains within the VPC, satisfying the condition that traffic stays within AWS. With an internet-facing NLB, Route 53 latency-based routing can be used to distribute traffic to the closest healthy NLB across regions.

Options B, C, D, and E are incorrect: B incorrectly relies on an internal ALB with PrivateLink, which does not support Route 53 latency routing and does not preserve source IP; C and E use ALB, which does not preserve source IP; D uses Global Accelerator, which does not use Route 53 and does not preserve source IP when ALB is an endpoint.

Exam trap

The trap is that many candidates assume an Application Load Balancer (ALB) or Global Accelerator can preserve the client source IP. However, ALB terminates the client connection and does not preserve the source IP. Only Network Load Balancer (NLB) preserves the source IP by default.

Additionally, Route 53 latency-based routing requires a DNS endpoint; NLB provides this with its DNS name.

How to eliminate wrong answers

Option A is wrong because an NLB with targets in public subnets does not preserve the original client source IP when forwarding to targets (NLB preserves source IP only for UDP or TCP traffic, but the requirement is for an ALB-based application); also, public subnets expose targets to the internet, violating the 'traffic stays within AWS' requirement. Option C is wrong because an internet-facing ALB does not preserve the client source IP when forwarding to targets (ALB replaces source IP with its own private IP); additionally, targets in private subnets would receive traffic with the ALB's IP, not the client's IP. Option D is wrong because AWS Global Accelerator with client IP preservation enabled does preserve source IP, but it does not use Route 53 latency-based routing (Global Accelerator uses Anycast IPs and its own routing algorithm); the question specifically requires Route 53 latency-based routing.

Option E is wrong because placing targets in public subnets to preserve source IP is incorrect—ALB always replaces the source IP regardless of subnet placement; also, public subnets expose targets to the internet, violating the 'traffic stays within AWS' requirement.

Practice this question →

22

Multi-Selecteasy

A company is deploying an AWS Client VPN endpoint to provide remote access to its VPC resources. The company wants to allow clients to access resources in multiple subnets within the VPC. Which TWO configurations are necessary?

Select 2 answers

A.Configure route tables in the VPC to direct traffic to the Client VPN endpoint.

B.Associate the Client VPN endpoint with subnets in the VPC.

C.Create authorization rules to allow access to the target networks.

D.Attach the VPC to a transit gateway.

E.Configure security groups on the target subnets.

AnswersB, C

Subnet associations allow the endpoint to have elastic network interfaces in those subnets.

Why this answer

Associating the Client VPN endpoint with subnets in the VPC is required to establish the network connectivity between the VPN clients and the VPC. The Client VPN endpoint uses elastic network interfaces in the associated subnets to route traffic from clients into the VPC. Without this association, the endpoint cannot forward traffic to VPC resources.

Exam trap

The trap here is that candidates often confuse authorization rules (which control access to target networks) with network connectivity requirements, leading them to think that only subnet association is needed, or they mistakenly believe that VPC route tables must be manually configured to point to the Client VPN endpoint, when in fact the endpoint automatically propagates routes into the associated subnet route tables.

Practice this question →

23

Multi-Selectmedium

Which THREE of the following are considerations when designing a VPC with multiple Availability Zones for high availability? (Choose THREE.)

Select 3 answers

A.Use an Application Load Balancer to distribute traffic across instances in different Availability Zones.

B.Create a single public subnet that spans all Availability Zones.

C.Deploy NAT gateways in each Availability Zone for redundancy.

D.Create separate subnets in each Availability Zone for the application tier.

E.Use a single NAT gateway in one Availability Zone to reduce cost.

AnswersA, C, D

ALB can route traffic to multiple AZs.

Why this answer

An Application Load Balancer (ALB) distributes incoming traffic across multiple targets, such as EC2 instances, in different Availability Zones (AZs). By registering instances from multiple AZs with the ALB, you ensure that if one AZ becomes unavailable, the ALB can route traffic to healthy instances in another AZ, thereby maintaining high availability. This aligns with the AWS Well-Architected Framework's recommendation to deploy workloads across multiple AZs and use a load balancer to handle failover.

Exam trap

The ANS-C01 exam often tests the misconception that a single subnet can span multiple Availability Zones, but AWS strictly requires each subnet to be confined to one AZ, and candidates may also incorrectly assume that a single NAT gateway is sufficient for high availability if they overlook the single point of failure risk.

Practice this question →

24

MCQmedium

A company has a VPC with an IPv6 CIDR block and wants to provide internet access to instances in a private subnet using an egress-only internet gateway. Which of the following must be configured correctly?

A.Configure NAT64 on the VPC to translate IPv6 to IPv4.

B.Enable route propagation for the egress-only internet gateway in the route table.

C.Add a default route (::/0) in the private subnet's route table pointing to the egress-only internet gateway.

D.Assign an IPv6 address to the egress-only internet gateway.

AnswerC

This allows IPv6 traffic from the private subnet to reach the internet outbound.

Why this answer

An egress-only internet gateway (EIG) is a horizontally scaled, redundant VPC component that allows outbound-only IPv6 traffic from instances in a private subnet to the internet, while preventing unsolicited inbound connections. To use it, you must add a default route (::/0) in the private subnet's route table pointing to the EIG, which directs all outbound IPv6 traffic through the gateway. This configuration ensures that instances can initiate outbound IPv6 connections (e.g., to download updates) but cannot be reached from the internet.

Exam trap

The ANS-C01 exam often tests the misconception that an egress-only internet gateway requires an IPv6 address assignment or that it behaves like a NAT gateway for IPv6, leading candidates to choose Option D or Option A, when in fact it is a stateless gateway that only requires a route table entry.

How to eliminate wrong answers

Option A is wrong because NAT64 is used to translate IPv6 traffic to IPv4 for communication with IPv4-only endpoints, but the question specifies IPv6-only internet access via an egress-only internet gateway, which does not require any IPv4 translation. Option B is wrong because route propagation is a feature for dynamic routing protocols (e.g., BGP) with virtual private gateways or Direct Connect, not for egress-only internet gateways, which are static and do not support route propagation. Option D is wrong because an egress-only internet gateway is a logical gateway that does not require an IPv6 address assignment; it operates at the VPC level and uses the VPC's IPv6 CIDR block for routing, not a specific IP address on the gateway itself.

Practice this question →

25

MCQhard

A company is designing a multi-account AWS environment using AWS Organizations. They need to centralize VPC flow logs and network traffic inspection across all accounts. Which architecture meets these requirements with minimal operational overhead?

A.Deploy a central inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic from all VPCs through it.

B.Use AWS Network Firewall in each VPC and aggregate logs centrally.

C.Enable VPC flow logs in each account and send them to a central S3 bucket. Use Network Access Analyzer for inspection.

D.Create VPC peering connections between all VPCs and deploy a third-party firewall in one VPC.

AnswerA

Centralized inspection with AWS Network Firewall and Transit Gateway is recommended.

Why this answer

It uses a central inspection VPC with AWS Network Firewall and Transit Gateway to route traffic from all VPCs through a single inspection point. This architecture centralizes both VPC flow logs and traffic inspection with minimal operational overhead, as Transit Gateway simplifies network connectivity and AWS Network Firewall provides managed, scalable inspection without per-account firewall management.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering can replace Transit Gateway for centralized inspection, but VPC peering is non-transitive and requires a full mesh, making it unscalable and operationally heavy — Transit Gateway is the correct service for transitive routing with minimal overhead.

How to eliminate wrong answers

Option B is wrong because deploying AWS Network Firewall in each VPC increases operational overhead significantly, as each firewall must be individually managed, updated, and scaled, and it does not inherently centralize flow logs or inspection — logs would still need to be aggregated separately. Option C is wrong because enabling VPC flow logs and sending them to a central S3 bucket only centralizes log storage, not traffic inspection; Network Access Analyzer is a static analysis tool for identifying unintended network access, not a real-time traffic inspection solution. Option D is wrong because creating VPC peering connections between all VPCs creates a full-mesh topology that does not scale and introduces transitive routing limitations (VPC peering is non-transitive), and deploying a third-party firewall in one VPC requires manual routing configuration and does not provide centralized, managed inspection across all VPCs.

Practice this question →

26

MCQeasy

A company is using a Network Load Balancer (NLB) to distribute traffic to a fleet of EC2 instances. The NLB is configured with a target group that has health checks enabled. Some instances are marked as unhealthy even though they are running and responding to requests on the health check port. What is a likely cause?

A.The route table for the NLB subnet does not have a route to the internet.

B.The security group for the EC2 instances does not allow inbound traffic from the VPC CIDR on the health check port.

C.The internet gateway is not attached to the VPC.

D.The health check is being blocked by a network ACL that allows inbound traffic only from the internet.

AnswerB

NLB health checks come from the VPC CIDR; security group must allow that traffic.

Why this answer

When a Network Load Balancer performs health checks, it sends requests from its private IP addresses within the NLB subnet to the target instances. The security group on the EC2 instances must explicitly allow inbound traffic from the VPC CIDR (or the NLB subnet CIDR) on the health check port. If the security group only allows traffic from the internet or a different source, the health check packets are dropped, causing the instances to be marked unhealthy even though they are running and responding to other traffic.

Exam trap

The trap here is that candidates often focus on internet-facing connectivity (IGW, route tables) or network ACLs, but the most direct and common cause for health check failures with NLB is the security group on the target instances not allowing traffic from the NLB's subnet.

How to eliminate wrong answers

Option A is wrong because the NLB operates within the VPC and does not require a route to the internet for health checks; health check traffic stays within the VPC. Option C is wrong because an internet gateway is not required for NLB health checks; the NLB and targets can be in a private subnet with no internet access. Option D is wrong because a network ACL that allows inbound traffic only from the internet would block health check traffic from the NLB's private IPs, but the question states the health check is being blocked; however, the more common and direct cause is the security group, and network ACLs are stateless and would need explicit rules for the NLB subnet, but the security group is the first line of defense and the typical misconfiguration.

Practice this question →

27

MCQmedium

A company has multiple VPCs connected via a Transit Gateway. The security team wants to centrally inspect all traffic between VPCs using a third-party firewall appliance. The appliance must be deployed in a single VPC and all inter-VPC traffic must be routed through it. Which architecture should be used?

A.Configure the Transit Gateway with a central inspection VPC that hosts the firewall appliance

B.Create a Network Load Balancer in each VPC and point to the firewall

C.Deploy AWS Network Firewall in each VPC

D.Use VPC peering connections between all VPCs and route traffic through the inspection VPC

AnswerA

Transit Gateway supports central inspection by routing traffic through a dedicated inspection VPC.

Why this answer

A Transit Gateway supports centralised inspection by attaching a dedicated inspection VPC that hosts the third‑party firewall appliance. By adjusting the Transit Gateway route tables, all inter‑VPC traffic can be forced through the inspection VPC using static routes or a default route pointing to the firewall’s elastic network interface, enabling full traffic inspection without modifying individual VPC route tables.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering can be used for transitive routing, but in AWS, VPC peering does not support transitive routing, so traffic cannot be routed through a third VPC without a Transit Gateway or a more complex hub‑and‑spoke design.

How to eliminate wrong answers

Option B is wrong because a Network Load Balancer (NLB) distributes traffic to targets but does not enforce routing; it cannot force all inter‑VPC traffic through a single inspection point without complex, unsupported routing changes. Option C is wrong because deploying AWS Network Firewall in each VPC creates a distributed inspection model, not a centralised one, and fails to meet the requirement of a single inspection VPC. Option D is wrong because VPC peering does not support transitive routing; traffic between two peered VPCs cannot be routed through a third VPC unless you use a Transit Gateway or a more complex hub‑and‑spoke design with multiple peering connections and custom routing, which is not scalable or recommended.

Practice this question →

28

MCQmedium

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block and ensure that traffic from the internet to the IPv6-enabled resources is allowed. Which configuration is required?

A.Attach a NAT gateway to the VPC and update route tables.

B.Attach an internet gateway and update route tables for IPv6.

C.Create a Virtual Private Gateway and attach the VPC.

D.Create a Transit Gateway and attach the VPC.

AnswerB

IGW supports IPv6 traffic.

Why this answer

To enable IPv6 communication from the internet to resources in a VPC, you must associate an IPv6 CIDR block with the VPC, attach an internet gateway, and update the route tables to include a default route (::/0) pointing to the internet gateway for IPv6 traffic. Option B correctly describes this configuration, as the internet gateway handles both IPv4 and IPv6 traffic, and route tables must be explicitly updated for IPv6.

Exam trap

The trap here is that candidates often confuse the internet gateway's role with NAT or VPN devices, assuming IPv6 requires a separate gateway or translation mechanism, when in fact the internet gateway natively handles IPv6 with proper route table entries.

How to eliminate wrong answers

Option A is wrong because a NAT gateway is used for outbound-only IPv4 traffic from private subnets to the internet, not for inbound IPv6 traffic from the internet. Option C is wrong because a Virtual Private Gateway is used for site-to-site VPN or Direct Connect connections, not for internet-facing IPv6 traffic. Option D is wrong because a Transit Gateway is used for inter-VPC or on-premises network connectivity, not for direct internet access to VPC resources.

Practice this question →

29

MCQmedium

A company has a VPC peering connection between VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Both VPCs have route tables that include routes to each other's CIDR blocks via the peering connection. Instances in VPC A can ping instances in VPC B, but traffic to an Application Load Balancer (ALB) in VPC B fails. The ALB is in public subnets with internet-facing scheme. What is the most likely cause?

A.The VPC peering connection does not support transitive routing for ALBs

B.The ALB is internet-facing and cannot be accessed from a peered VPC

C.The route tables in VPC B do not have a route back to VPC A

D.The ALB security group does not allow inbound traffic from VPC A

AnswerD

The security group must allow inbound traffic from the peered VPC's CIDR.

Why this answer

The most likely cause is that the ALB's security group does not allow inbound traffic from VPC A. Even though the VPC peering connection is properly configured and ICMP traffic (ping) works, HTTP/HTTPS traffic to the ALB is controlled by security groups. The ALB's security group must explicitly permit inbound traffic from the CIDR block of VPC A (10.0.0.0/16) or from the security group of the instances in VPC A.

Without this rule, the ALB will drop the traffic, even though the network path is functional.

Exam trap

The trap here is that candidates assume that because ping works, all traffic should work, overlooking that security groups operate at Layer 4 and must explicitly permit the specific protocol and port (e.g., TCP/80 or TCP/443) from the source VPC's CIDR.

How to eliminate wrong answers

Option A is wrong because VPC peering does support traffic to an ALB; transitive routing is irrelevant here as there are only two VPCs directly peered, and ALBs can be accessed via a peering connection as long as security groups and route tables allow it. Option B is wrong because an internet-facing ALB can indeed be accessed from a peered VPC; the 'internet-facing' scheme only means it has public IPs and routes to the internet, but it does not restrict access from private IPs in a peered VPC. Option C is wrong because the question states that route tables in both VPCs include routes to each other's CIDR blocks via the peering connection, and ping works, confirming that return routing is properly configured.

Practice this question →

30

MCQmedium

A company is deploying a VPC with public and private subnets in two Availability Zones. The private subnets need outbound internet access for software updates but must not be reachable from the internet. Which AWS service should be used to achieve this?

A.VPC Peering

B.Virtual Private Gateway

D.Internet Gateway

AnswerC

NAT Gateway provides outbound internet access for private subnets without allowing unsolicited inbound connections.

Why this answer

A NAT Gateway enables instances in private subnets to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing the internet from initiating connections back to those instances. It resides in a public subnet with an Elastic IP and uses source network address translation (SNAT) to translate private source IPs to the gateway's public IP, ensuring the private instances remain unreachable from external hosts.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with an Internet Gateway, mistakenly thinking an Internet Gateway can be placed in a private subnet to provide outbound-only access, but an Internet Gateway is a VPC-level construct that always allows bidirectional traffic if a route to it exists.

How to eliminate wrong answers

Option A is wrong because VPC Peering connects two VPCs privately using AWS's internal infrastructure; it does not provide internet access and cannot route traffic to or from the internet. Option B is wrong because a Virtual Private Gateway is used to establish a VPN or Direct Connect connection between a VPC and an on-premises network, not for outbound internet access from private subnets. Option D is wrong because an Internet Gateway allows bidirectional communication between a VPC and the internet; attaching it directly to a private subnet would make instances reachable from the internet, violating the requirement that they must not be reachable from the internet.

Practice this question →

31

MCQeasy

A company is implementing a hybrid network using AWS Site-to-Site VPN. The on-premises firewall requires that the VPN tunnels use IKEv2 with pre-shared keys and that the tunnels are always active. Which VPN configuration should be used?

A.Two VPN tunnels in active/passive mode

B.Two VPN tunnels with static routing

C.One VPN tunnel with static routing

D.Two VPN tunnels in active/active mode with BGP

AnswerD

Active/active tunnels with BGP provide high availability and always-on connectivity.

Why this answer

IKEv2 with pre-shared keys and always-active tunnels require both tunnels to be in active/active mode, which is achieved by using BGP to advertise the same routes over both tunnels. BGP enables dynamic routing and ensures both tunnels are used simultaneously, meeting the requirement for continuous active connectivity.

Exam trap

The trap here is that candidates often assume active/passive mode is required for redundancy, but the question explicitly states 'tunnels are always active,' which mandates active/active mode with BGP to keep both tunnels up and forwarding traffic simultaneously.

How to eliminate wrong answers

Option A is wrong because active/passive mode means only one tunnel is active at a time, which does not satisfy the requirement that both tunnels are always active. Option B is wrong because static routing does not support active/active operation; with static routing, one tunnel typically becomes the primary and the other remains passive, and failover is not dynamic. Option C is wrong because a single VPN tunnel provides no redundancy and cannot be 'always active' in the sense of having two active tunnels as required.

Practice this question →

32

MCQmedium

A company has a VPC with a CIDR of 10.0.0.0/16. They need to connect to a partner's VPC with CIDR 10.0.0.0/16 using a VPC peering connection. What is the issue with this configuration?

A.The company has reached the maximum number of VPC peering connections

B.VPC peering is only supported within the same region

C.VPC peering does not support transitive routing

D.Overlapping CIDR ranges are not supported for VPC peering

AnswerD

VPC peering requires non-overlapping CIDR blocks to enable routing between them.

Why this answer

VPC peering requires that the CIDR blocks of the peered VPCs do not overlap. In this case, both VPCs use 10.0.0.0/16, which creates an identical address space. When routes are added to the route tables for the peering connection, the destination CIDR would be ambiguous, and the VPC cannot distinguish between local resources and those in the peered VPC, leading to routing conflicts.

AWS explicitly rejects peering requests between VPCs with overlapping or identical CIDR ranges.

Exam trap

The ANS-C01 exam often tests the overlapping CIDR restriction for VPC peering, and the trap here is that candidates may focus on transitive routing or regional limitations instead of recognizing that the fundamental prerequisite of non-overlapping IP ranges is violated.

How to eliminate wrong answers

Option A is wrong because the question does not mention any existing peering connections, and the default limit for VPC peering connections per VPC is 125 (which can be increased), so reaching the maximum is not the issue here. Option B is wrong because VPC peering supports cross-region peering (inter-region VPC peering) as well as same-region peering, so the statement that it is only supported within the same region is incorrect. Option C is wrong while it is true that VPC peering does not support transitive routing, that is not the primary issue in this scenario; the core problem is the overlapping CIDR ranges, which prevents the peering connection from being established at all.

Practice this question →

33

MCQeasy

A company is deploying a multi-tier application on AWS and needs to ensure that traffic between the web tier and the application tier does not traverse the internet. Both tiers are deployed in the same VPC but in different subnets. What is the MOST secure way to meet this requirement?

A.Use an Internet Gateway to route traffic between subnets

B.Use VPC Peering between the subnets

C.Use a NAT Gateway in each subnet for inter-subnet communication

D.Use route tables and security groups to allow traffic within the VPC

AnswerD

Correct; local routes already enable communication within a VPC; security groups and NACLs provide security.

Why this answer

The most secure way to ensure that traffic between the web tier and the application tier does not traverse the internet is to use route tables and security groups to allow traffic within the VPC. Both tiers are in the same VPC but in different subnets, so traffic stays within the VPC by default if routing is configured correctly. Route tables direct traffic between subnets, and security groups act as virtual firewalls to control inbound and outbound traffic.

Option D is correct. Option A is wrong because an Internet Gateway is used for internet access, not for routing within a VPC. Option B is wrong because VPC Peering connects different VPCs, not subnets within the same VPC.

Option C is wrong because a NAT Gateway is for outbound internet access from private subnets, not for inter-subnet communication.

Practice this question →

34

Multi-Selectmedium

A company is implementing a hybrid network architecture with an AWS Transit Gateway connecting multiple VPCs and an on-premises data center via AWS Direct Connect. The company needs to ensure that traffic between VPCs is inspected by a centralized security appliance running on EC2 instances in a dedicated inspection VPC. To achieve this, traffic must be routed through the inspection VPC before reaching its destination. Which TWO configurations are required? (Choose two.)

Select 2 answers

A.Enable route propagation for all VPC attachments in the Transit Gateway route table.

B.Create a blackhole route in the Transit Gateway route table for the VPC CIDR blocks that are destined for other VPCs.

C.Add a static route in the inspection VPC route tables pointing to the Transit Gateway for all other VPC CIDRs.

D.Configure a VPC Gateway Endpoint for the inspection VPC to attract traffic.

E.Deploy a NAT gateway in each VPC to route traffic through the inspection VPC.

AnswersB, C

Prevents direct routing between VPCs.

Why this answer

To force traffic between VPCs through a centralized inspection VPC, you need to prevent direct communication between VPCs and instead route traffic via the inspection VPC. Option B creates a blackhole route in the Transit Gateway route table for the VPC CIDR blocks destined for other VPCs. This drops traffic that would otherwise be directly forwarded between VPCs, forcing it to go through the inspection VPC.

Option C adds a static route in the inspection VPC's route tables pointing to the Transit Gateway for all other VPC CIDRs. This ensures that traffic entering the inspection VPC is forwarded to the Transit Gateway and then to the destination VPC. Option A is incorrect because enabling route propagation would automatically advertise VPC routes, allowing direct VPC-to-VPC communication.

Option D is incorrect because a VPC Gateway Endpoint is used for private access to AWS services (like S3 or DynamoDB), not for inter-VPC traffic inspection. Option E is incorrect because a NAT gateway is used for outbound internet traffic, not for routing traffic between VPCs.

Practice this question →

35

Multi-Selecthard

A company uses AWS Transit Gateway with multiple VPC attachments and a VPN attachment to an on-premises network. The on-premises network advertises the same prefix via two separate VPN connections for redundancy. The TGW route table shows both routes as active. Traffic from a VPC to on-premises is not load-balanced and prefers one connection. Which THREE actions would help achieve active-active load balancing? (Choose 3.)

Select 3 answers

A.Configure BGP AS_PATH prepending on the preferred VPN connection to make it less preferred

B.Enable equal-cost multi-path (ECMP) routing on the Transit Gateway route table

C.Set a higher BGP weight on the less preferred connection

D.Use static routes for both VPN connections instead of BGP

E.Adjust the BGP Multi-Exit Discriminator (MED) attribute on the on-premises routers

AnswersA, B, E

AS_PATH prepending can make one path appear longer.

Why this answer

BGP AS_PATH prepending artificially increases the AS path length for routes advertised over the preferred VPN connection, making them less preferred by BGP's path selection algorithm. This causes the Transit Gateway to prefer the other VPN connection for those prefixes, enabling active-active load balancing when combined with ECMP.

Exam trap

The trap here is that candidates assume BGP weight (a Cisco-proprietary attribute) can be used on AWS Transit Gateway, but AWS only supports standard BGP attributes and does not implement weight, making option C a distractor.

Practice this question →

36

MCQhard

A company is implementing a hybrid network using AWS Direct Connect and VPN backup. The company has two Direct Connect connections from different providers and a site-to-site VPN as a backup. The company wants to ensure that traffic is always routed through the Direct Connect connections when they are healthy, and only fails over to the VPN if both Direct Connect connections fail. Which BGP configuration should be used on the customer gateway device (CGW) to achieve this?

A.Set a lower BGP Local Preference value for routes received from the VPN connection.

B.Apply a BGP community tag to routes received over the VPN to signal less preference.

C.Set a higher BGP Multi-Exit Discriminator (MED) value for routes advertised over the VPN.

D.Prepend AS_PATH on routes advertised over the Direct Connect connections.

AnswerA

Lower Local Preference makes the VPN routes less preferred, so Direct Connect routes are used when available.

Why this answer

BGP Local Preference is a well-known mandatory attribute used to influence outbound traffic from the AS. By setting a lower Local Preference value for routes received from the VPN connection, the customer gateway device (CGW) will prefer routes learned via Direct Connect (which have a default or higher Local Preference) over those learned via VPN. This ensures traffic is routed through Direct Connect connections when they are healthy, and only fails over to the VPN if both Direct Connect connections fail.

Exam trap

The ANS-C01 exam often tests the confusion between BGP attributes that influence outbound vs. inbound traffic; the trap here is that candidates mistakenly apply MED or AS_PATH prepending (which affect inbound path selection) when the question explicitly asks for controlling outbound traffic from the customer side.

How to eliminate wrong answers

Option B is wrong because BGP community tags are not directly used to influence route preference in a standardized way; they are often used for tagging and filtering, and while some providers may interpret specific communities to adjust preference, this is not a reliable or standard method for controlling outbound traffic preference on the CGW. Option C is wrong because the Multi-Exit Discriminator (MED) is used to influence inbound traffic (how other ASes enter your network), not outbound traffic from your AS; setting a higher MED on routes advertised over the VPN would affect how the AWS side chooses paths, not how the CGW chooses which path to use. Option D is wrong because prepending AS_PATH on routes advertised over Direct Connect would make those routes appear less preferred to external peers (inbound direction), but the goal is to influence the CGW's outbound path selection; AS_PATH prepending does not affect the CGW's own route preference for received routes.

Practice this question →

37

Multi-Selectmedium

A network engineer is troubleshooting connectivity issues between two VPCs connected via a Transit Gateway. The VPCs are in the same region and have proper route tables. Which TWO actions should the engineer perform to diagnose the problem?

Select 2 answers

A.Verify that the VPC route tables have routes pointing to the Transit Gateway attachment.

B.Check the security groups of the Transit Gateway.

C.Ping the Transit Gateway to verify its status.

D.Examine the network ACLs for the Transit Gateway.

E.Review VPC Flow Logs for the subnets to see if traffic is being blocked.

AnswersA, E

Missing routes would prevent traffic from reaching the Transit Gateway.

Why this answer

For traffic to flow from a VPC to a Transit Gateway, the VPC's route tables must include a route pointing to the Transit Gateway attachment (e.g., 10.0.0.0/16 -> tgw-xxx). Without this route, the VPC has no path to send traffic into the Transit Gateway, causing connectivity failure regardless of other configurations.

Exam trap

The ANS-C01 exam often tests the misconception that Transit Gateway has its own security groups or NACLs, leading candidates to incorrectly select options B or D, when in fact these constructs only exist at the VPC/subnet level.

Practice this question →

38

MCQeasy

A company is migrating a legacy application to AWS. The application requires multicast traffic between EC2 instances. Which AWS service can support multicast within a VPC?

A.VPC native multicast

B.Amazon CloudFront

C.Application Load Balancer

D.Transit Gateway with multicast domain

AnswerD

Transit Gateway supports multicast.

Why this answer

AWS Transit Gateway supports multicast traffic through the creation of a multicast domain, which allows EC2 instances in different VPCs or subnets to send and receive multicast traffic. This is the only native AWS service that supports multicast within a VPC environment, making it the correct choice for migrating a legacy application that requires multicast.

Exam trap

The trap here is that candidates may assume 'VPC native multicast' exists because of the term 'native' or confuse multicast with broadcast or unicast features, but AWS VPC does not support multicast natively, and Transit Gateway is the required service.

How to eliminate wrong answers

Option A is wrong because AWS VPC does not natively support multicast traffic; multicast is not a feature of standard VPCs. Option B is wrong because Amazon CloudFront is a content delivery network (CDN) that delivers content over HTTP/HTTPS and does not support multicast IP traffic between EC2 instances. Option C is wrong because an Application Load Balancer operates at Layer 7 and handles unicast HTTP/HTTPS traffic; it cannot forward or replicate multicast packets.

Practice this question →

39

MCQhard

A company uses AWS Direct Connect with a private VIF to connect to a VPC. They also have a VPN connection as a backup. How should they configure BGP to ensure that the VPN is only used when Direct Connect fails?

A.Use a lower local preference on the Direct Connect BGP session

B.Use a lower AS path prepend on the VPN BGP session

C.Use a higher local preference on the Direct Connect BGP session

D.Use a higher MED on the VPN BGP session

AnswerC

Higher local preference makes the Direct Connect route preferred.

Why this answer

Local preference is a BGP attribute used to influence outbound traffic from an AS. By setting a higher local preference on the Direct Connect BGP session, the router will prefer that path over the VPN session. When Direct Connect fails, the BGP session goes down, and the VPN route becomes the only available path, ensuring seamless failover.

Exam trap

The trap here is that candidates often confuse local preference (influences outbound path selection) with MED (influences inbound path selection) or AS path prepending (also influences inbound selection), leading them to choose options that would not achieve the desired primary/backup behavior for outbound traffic.

How to eliminate wrong answers

Option A is wrong because a lower local preference on the Direct Connect session would make it less preferred, causing the VPN to be used as the primary path, which contradicts the requirement. Option B is wrong because AS path prepending on the VPN session would make the VPN path less preferred (longer AS path), but the goal is to prefer Direct Connect; prepending on the VPN is unnecessary and could cause suboptimal routing if Direct Connect fails. Option D is wrong because MED (Multi-Exit Discriminator) is used to influence inbound traffic from a neighboring AS, not outbound traffic from the local AS; it does not affect which path the local router chooses for outbound traffic.

Practice this question →

40

MCQhard

Refer to the exhibit. An EC2 instance in a VPC is assigned a public IP via an Elastic IP address. The instance is not reachable from the internet, although it has a security group allowing inbound HTTP traffic from 0.0.0.0/0. The VPC has an Internet Gateway attached to the route table of the subnet. What is the MOST likely cause?

A.The subnet route table does not have a default route (0.0.0.0/0) to the Internet Gateway

B.The source/destination check is enabled and should be disabled

C.The security group is blocking inbound traffic

D.The Elastic IP is not correctly associated with the instance

AnswerA

For an instance with a public Elastic IP to be reachable from the internet, the subnet’s route table must contain a default route (0.0.0.0/0) pointing to the Internet Gateway. Without this route, outbound traffic from the instance cannot reach the internet, and inbound response traffic cannot return, even though the security group permits HTTP from 0.0.0.0/0 and the Internet Gateway is attached.

Why this answer

The most likely cause is that the subnet's route table lacks a default route (0.0.0.0/0) pointing to the Internet Gateway (IGW). Without this route, traffic destined for the internet from the instance has no path to the IGW, and return traffic from the internet cannot reach the instance. Even with a public Elastic IP and a permissive security group, the VPC's routing logic prevents internet-bound packets from being forwarded to the IGW.

Exam trap

The ANS-C01 exam often tests the misconception that a public IP and a permissive security group alone guarantee internet connectivity, ignoring the critical requirement of a default route to the Internet Gateway in the subnet's route table.

How to eliminate wrong answers

Option B is wrong because the source/destination check is relevant for NAT or routing instances, not for a standard EC2 instance that is the source or destination of its own traffic; disabling it is unnecessary for internet reachability. Option C is wrong because the security group explicitly allows inbound HTTP traffic from 0.0.0.0/0, so it is not blocking the traffic. Option D is wrong because if the Elastic IP were not correctly associated, the instance would not have a public IP at all, but the question states it is assigned an Elastic IP, and the issue is routing, not association.

Practice this question →

41

MCQeasy

A company needs to connect multiple VPCs to a common on-premises network through a single AWS Direct Connect connection. Which AWS service should be used to simplify this architecture?

A.AWS VPN CloudHub

B.AWS Transit Gateway

C.VPC peering

D.Virtual Private Gateway (VGW)

AnswerB

Acts as a hub for VPCs and on-premises networks.

Why this answer

AWS Transit Gateway acts as a central hub to interconnect multiple VPCs and on-premises networks through a single Direct Connect connection. It simplifies the architecture by replacing complex mesh or star topologies with a single gateway that manages routing and attachments, reducing operational overhead and cost.

Exam trap

The trap here is that candidates often confuse the Virtual Private Gateway (VGW) as a multi-VPC solution, not realizing it is per-VPC and lacks transitive routing, while Transit Gateway is the correct service for hub-and-spoke connectivity with a single Direct Connect.

How to eliminate wrong answers

Option A is wrong because AWS VPN CloudHub is designed for connecting multiple remote sites (e.g., branch offices) over IPsec VPNs, not for interconnecting VPCs or leveraging a single Direct Connect link. Option C is wrong because VPC peering creates point-to-point connections between VPCs and does not support transitive routing or a single Direct Connect attachment, requiring a full mesh for multiple VPCs. Option D is wrong because a Virtual Private Gateway (VGW) is a single-VPC attachment point for Direct Connect or VPN; it cannot be shared across multiple VPCs without additional complex routing and does not provide a hub-and-spoke architecture.

Practice this question →

42

Multi-Selectmedium

A company is designing a multi-tier application in a VPC. The web tier must be accessible from the internet, while the application tier must only be accessible from the web tier. The database tier must be isolated from all other tiers except the application tier. Which TWO network architectures meet these requirements? (Choose TWO.)

Select 2 answers

A.Use a single public subnet for all tiers and control access with security groups.

B.Use private subnets for all tiers and a NAT gateway for internet access from the web tier. Use security groups to control traffic.

C.Use a public subnet for an Application Load Balancer and private subnets for web, app, and database tiers. Use security groups to restrict traffic between tiers.

D.Use a VPN connection from the on-premises network to access all tiers.

E.Use public subnets for the web tier, private subnets for the application tier, and isolated subnets (no route to internet) for the database tier. Use security groups to allow traffic only from the web to app and app to database.

AnswersC, E

The ALB in public subnet provides inbound access; private subnets isolate tiers.

Why this answer

It places the Application Load Balancer in a public subnet to receive internet traffic, while the web, app, and database tiers reside in private subnets. Security groups are used to restrict traffic flows: the ALB security group allows inbound HTTP/HTTPS from the internet, the web tier security group allows inbound only from the ALB, the app tier security group allows inbound only from the web tier, and the database tier security group allows inbound only from the app tier. This ensures the application tier is only accessible from the web tier, and the database tier is isolated except from the application tier.

Exam trap

The ANS-C01 exam often tests the misconception that placing all tiers in private subnets with a NAT gateway can provide inbound internet access, but a NAT gateway only supports outbound-initiated traffic and cannot accept inbound connections from the internet.

Practice this question →

43

MCQeasy

A company is deploying a VPC with both public and private subnets. They have an EC2 instance in a private subnet that needs to access the internet for software updates. Which AWS service should be placed in a public subnet to enable this?

A.Internet gateway

B.VPC endpoint

C.Direct Connect virtual interface

AnswerD

A NAT gateway in a public subnet enables outbound internet access for instances in private subnets.

Why this answer

A NAT gateway is correct because it enables EC2 instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. The NAT gateway must be placed in a public subnet with an associated Internet Gateway to translate private IP addresses to the public IP of the NAT gateway for outbound traffic.

Exam trap

The ANS-C01 exam often tests the misconception that an Internet Gateway can be 'placed' in a subnet or that it directly provides outbound-only access for private instances, but the key trap is that an Internet Gateway alone cannot perform source NAT—it requires a NAT device (gateway or instance) in a public subnet to enable private instances to reach the internet.

How to eliminate wrong answers

Option A is wrong because an Internet Gateway (IGW) is a horizontally scaled, redundant component that allows communication between a VPC and the internet, but it must be attached to a public subnet's route table; placing an IGW in a subnet is not possible—it is a VPC-level resource, not a subnet resource, and it does not provide outbound-only translation for private instances. Option B is wrong because a VPC endpoint (e.g., Gateway or Interface endpoint) provides private connectivity to AWS services (like S3 or DynamoDB) without traversing the internet, but it cannot be used to reach general internet destinations for software updates. Option C is wrong because a Direct Connect virtual interface establishes a dedicated private network connection from on-premises to AWS, not internet access; it is used for hybrid connectivity, not for enabling internet-bound traffic from a private subnet.

Practice this question →

44

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. They have set up a Transit Gateway and attached the VPC and the Direct Connect gateway. The on-premises network can reach some VPC resources but not others. The VPC has multiple subnets with different CIDR blocks. The on-premises router is advertising the same prefixes over BGP. What is the most likely cause of the partial connectivity?

A.The VPC route tables for the subnets that cannot be reached do not have a route to the Transit Gateway for the on-premises prefixes.

B.The Direct Connect gateway association with the Transit Gateway is misconfigured.

C.The Transit Gateway route table does not have a static route or propagation for the on-premises prefixes.

D.The on-premises router is advertising different prefixes over BGP than expected.

AnswerA

Without a route in the VPC subnet route table pointing to the Transit Gateway, traffic from the VPC to on-premises will not be forwarded.

Why this answer

The most common cause of partial connectivity in this scenario is that the VPC route tables do not have routes pointing to the Transit Gateway for the on-premises prefixes. Even if the Transit Gateway has routes, the VPC subnets must send traffic to the Transit Gateway. Option A is correct.

Option B is incorrect because if the Transit Gateway route table had incorrect propagation, it would affect all prefixes equally. Option C is incorrect because the on-premises router advertising the same prefixes would not cause partial connectivity. Option D is incorrect because the Direct Connect gateway association is fine if some traffic works.

Practice this question →

45

MCQhard

A company is building a hybrid network with an AWS Transit Gateway connecting multiple VPCs and an on-premises network via Direct Connect. The on-premises network uses BGP to advertise routes to the Transit Gateway. One of the VPCs has an overlapping CIDR (10.0.0.0/16) with the on-premises network (10.0.0.0/8). The company wants to ensure that traffic from other VPCs to 10.0.0.0/16 goes to the VPC, not on-premises. What configuration is required?

A.Use AS_PATH prepending on the on-premises BGP advertisements to make them less preferred

B.No additional configuration is needed; the more specific route will be preferred automatically

C.Add a static route in the Transit Gateway route table for 10.0.0.0/16 pointing to the VPC attachment

D.Disable route propagation from the Direct Connect virtual interface to the Transit Gateway

AnswerB

Correct; Transit Gateway uses longest prefix match, so the /16 from VPC is preferred over /8 from on-premises.

Why this answer

AWS Transit Gateway route tables follow the longest prefix match rule. The VPC advertises 10.0.0.0/16, which is a more specific route than the on-premises 10.0.0.0/8. Therefore, traffic destined for 10.0.0.0/16 will automatically be forwarded to the VPC attachment without any additional configuration.

Exam trap

The trap here is that candidates often think BGP attributes like AS_PATH prepending are needed to influence route preference, forgetting that the longest prefix match rule takes precedence over any BGP path selection attribute.

How to eliminate wrong answers

Option A is wrong because AS_PATH prepending influences BGP path selection but does not override the fundamental longest prefix match rule; a more specific prefix (10.0.0.0/16) is always preferred over a less specific one (10.0.0.0/8) regardless of AS_PATH length. Option C is wrong because adding a static route for 10.0.0.0/16 is unnecessary and could cause conflicts or blackholing; the VPC's propagated route already provides the more specific match. Option D is wrong because disabling route propagation from the Direct Connect virtual interface would remove the on-premises routes entirely, which is not required and would break connectivity to non-overlapping on-premises destinations.

Practice this question →

46

MCQmedium

A company wants to establish a dedicated, private connection between their on-premises data center and AWS. They require consistent, low-latency performance and support for multiple VLANs. Which AWS service should they use?

A.AWS Direct Connect

B.AWS Transit Gateway

C.AWS Site-to-Site VPN

D.VPC Peering

AnswerA

Direct Connect provides a dedicated private connection with VLAN support.

Why this answer

AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from on-premises to AWS, bypassing the public internet to deliver consistent, low-latency performance. It supports multiple VLANs via 802.1Q tagging over a single physical connection, enabling segmentation of traffic (e.g., for private VIFs, public VIFs, and transit VIFs). This meets the requirement for a private, high-performance link with VLAN support.

Exam trap

The ANS-C01 exam often tests the misconception that Transit Gateway provides the dedicated connection itself, when in fact it is a logical routing construct that requires a physical or virtual underlay (Direct Connect or VPN) to reach on-premises.

How to eliminate wrong answers

Option B (AWS Transit Gateway) is wrong because it is a network transit hub that interconnects VPCs and on-premises networks, but it does not provide the physical dedicated connection itself; it requires an underlying connection like Direct Connect or VPN. Option C (AWS Site-to-Site VPN) is wrong because it uses the public internet with IPSec tunnels, which introduces variable latency and does not guarantee consistent low-latency performance or dedicated bandwidth. Option D (VPC Peering) is wrong because it connects VPCs within AWS using the AWS backbone, but it cannot extend to an on-premises data center and does not support VLANs or dedicated private connectivity.

Practice this question →

47

MCQeasy

A company needs to connect its on-premises data center to AWS with a dedicated, private network connection that provides consistent performance. Which AWS service should they use?

A.Internet Gateway

B.VPC Endpoint

C.AWS Direct Connect

D.Site-to-Site VPN

AnswerC

Direct Connect provides a dedicated, private connection with consistent bandwidth.

Why this answer

AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet. This ensures consistent, low-latency performance and can reduce bandwidth costs for high-volume data transfer, making it the ideal choice for the stated requirement.

Exam trap

AWS often tests the misconception that a Site-to-Site VPN provides dedicated performance because it is encrypted, but the trap is that VPNs still traverse the public internet and cannot guarantee consistent bandwidth or latency like a dedicated physical connection (Direct Connect).

How to eliminate wrong answers

Option A is wrong because an Internet Gateway is a horizontally scaled, redundant component that allows VPC communication with the internet over the public internet, not a dedicated private connection, and performance can be variable due to internet congestion. Option B is wrong because a VPC Endpoint enables private connectivity to AWS services (e.g., S3, DynamoDB) from within a VPC using AWS PrivateLink, but it does not extend to an on-premises data center; it is a service-specific endpoint, not a site-to-site connection. Option D is wrong because a Site-to-Site VPN creates an encrypted tunnel over the public internet, which introduces latency variability and potential throughput limitations due to internet conditions, failing to provide the consistent, dedicated performance required.

Practice this question →

48

MCQmedium

Refer to the exhibit. A CloudFormation template creates a VPC with public and private subnets. The template includes an Internet Gateway and a route table with a default route to the IGW, associated with the public subnet. An EC2 instance launched in the public subnet cannot be reached from the internet. The security group allows inbound HTTP from 0.0.0.0/0. What is the MOST likely missing resource?

A.A VPN connection to the VPC

B.A NAT Gateway in the public subnet

C.An Elastic IP address assigned to the instance or auto-assign public IP enabled on the subnet

D.A route table for the private subnet

AnswerC

Public instances need a public IP to be reachable.

Why this answer

The EC2 instance in the public subnet cannot be reached from the internet because it lacks a publicly routable IP address. Even though the subnet has a default route to the Internet Gateway (IGW) and the security group allows inbound HTTP from 0.0.0.0/0, the instance must have either an Elastic IP address assigned directly or the subnet must have the 'Auto-assign public IPv4 address' attribute enabled. Without a public IP, the IGW cannot perform 1-to-1 NAT to translate the instance's private IP to a public IP, making it unreachable from the internet.

Exam trap

The ANS-C01 exam often tests the misconception that a route to an IGW and a permissive security group are sufficient for internet access, but candidates overlook the mandatory requirement for a public IP address on the instance or subnet for inbound connectivity.

How to eliminate wrong answers

Option A is wrong because a VPN connection is used for private connectivity to an on-premises network, not for providing internet access to a public subnet instance. Option B is wrong because a NAT Gateway is used to allow instances in private subnets to initiate outbound internet traffic, not to enable inbound internet access to instances in a public subnet. Option D is wrong because a route table for the private subnet is irrelevant to the public subnet's internet connectivity; the issue is the lack of a public IP on the instance, not missing routes in the private subnet.

Practice this question →

49

Multi-Selecthard

Which THREE of the following are required to establish a highly available site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)

Select 3 answers

A.Two separate VPN connections

B.Two VPN tunnels (one primary, one secondary)

C.A customer gateway resource in AWS

D.A virtual private gateway attached to the VPC

E.An AWS Direct Connect connection

AnswersB, C, D

Two tunnels provide redundancy.

Why this answer

AWS Site-to-Site VPN requires two tunnels per VPN connection to provide high availability. Each tunnel uses separate endpoints and paths; if one tunnel fails, traffic automatically fails over to the other. This design ensures continuous connectivity even during maintenance or failures.

Exam trap

The ANS-C01 exam often tests the misconception that two separate VPN connections are needed for high availability, when in fact a single VPN connection with two tunnels is the correct AWS design.

Practice this question →

50

Multi-Selectmedium

A company is deploying a VPC with a CIDR block of 10.0.0.0/16. The VPC requires six subnets: three public and three private, each with a /24 CIDR. The company needs to ensure high availability across three Availability Zones. Which TWO of the following are valid subnet CIDR assignments that meet these requirements?

Select 2 answers

A.Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.0.0/25, 10.0.1.0/25, 10.0.2.0/25

B.Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.3.0/24, 10.0.4.0/24, 10.0.5.0/24

C.Public: 10.0.0.0/24, 10.0.2.0/24, 10.0.4.0/24; Private: 10.0.1.0/24, 10.0.3.0/24, 10.0.5.0/24

D.Public: 10.0.0.0/24, 10.0.0.0/25, 10.0.0.128/25; Private: 10.0.1.0/24, 10.0.1.0/25, 10.0.1.128/25

E.Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.0.0/25, 10.0.1.0/25, 10.0.2.0/25

AnswersB, C

Non-overlapping, three AZs each.

Why this answer

It assigns six non-overlapping /24 subnets (10.0.0.0/24 through 10.0.5.0/24) within the 10.0.0.0/16 VPC, allowing three public and three private subnets to be distributed across three Availability Zones for high availability. Option C is also correct as it uses the same six /24 subnets but interleaves public and private ranges (e.g., public: 10.0.0.0/24, 10.0.2.0/24, 10.0.4.0/24; private: 10.0.1.0/24, 10.0.3.0/24, 10.0.5.0/24), which still provides non-overlapping /24 CIDRs and supports the required multi-AZ architecture.

Exam trap

The trap here is that candidates often assume subnets can share the same base IP range as long as the subnet mask differs, but AWS requires all subnets in a VPC to have non-overlapping CIDR blocks regardless of prefix length.

Practice this question →

51

MCQhard

A company has a Direct Connect connection with a private VIF to a Direct Connect gateway. The VIF is associated with a Direct Connect gateway that has a virtual private gateway (VGW) attachment to a VPC. The on-premises network is advertising a route to 10.0.0.0/16. However, the VPC cannot reach on-premises resources. The VPC has a route table with a route to 10.0.0.0/16 pointing to the VGW. What is the MOST likely cause?

A.The VPC route table does not have route propagation enabled for the virtual private gateway

B.The on-premises router is not using BGP to advertise routes

C.The security group on the VPC instances is blocking inbound traffic

D.The Direct Connect gateway does not support the prefix 10.0.0.0/16

AnswerB

BGP is required for private VIF, but the VGW may still receive routes.

Why this answer

The VPC route table already contains a static route to 10.0.0.0/16 pointing to the VGW, so route propagation is not required for this specific destination. However, for the VGW to forward traffic to on-premises, it must have learned the on-premises route via BGP from the Direct Connect gateway. If the on-premises router is not using BGP to advertise the 10.0.0.0/16 route, the Direct Connect gateway and therefore the VGW will not have a route to that prefix, causing traffic from the VPC to be dropped.

Enabling route propagation on the VPC route table would not help because the route is already statically defined. Therefore, the most likely cause is that the on-premises router is not using BGP to advertise routes.

Exam trap

The ANS-C01 exam often tests the understanding that a static route to the VGW is sufficient for routing, but candidates must verify that BGP is properly advertising on-premises routes to the Direct Connect gateway; otherwise, the VGW will not know how to reach on-premises, even with a static VPC route.

How to eliminate wrong answers

Option B is wrong because the on-premises router is already advertising the route 10.0.0.0/16 via BGP over the private VIF, as stated in the scenario. Option C is wrong because security groups are stateful and only control traffic to/from instances; they do not affect route propagation or the VPC's ability to reach the on-premises network at the routing level. Option D is wrong because Direct Connect gateways support any valid IPv4 prefix, including 10.0.0.0/16, and there is no prefix-based restriction in the Direct Connect gateway configuration.

Practice this question →

52

MCQhard

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a CIDR of 10.0.0.0/16 and an on-premises network with CIDR 10.0.0.0/8. The Transit Gateway route table has a static route for 10.0.0.0/8 pointing to the VPN attachment. However, traffic from on-premises to the VPC is not working. What is the most likely cause?

A.The VPN attachment is in the wrong TGW route table.

B.The VPC route table does not have a route pointing to the Transit Gateway for on-premises traffic.

C.The VPC CIDR overlaps with the on-premises CIDR.

D.The Transit Gateway route table does not have a route for the VPC CIDR.

AnswerB

Return traffic needs a route to TGW.

Why this answer

For traffic from on-premises to reach the VPC, the VPC's route table must have a route pointing to the Transit Gateway (TGW) attachment as the target for the on-premises CIDR (10.0.0.0/8). Without this route, the VPC subnet will not forward return traffic to the TGW, causing a one-way communication failure. The TGW route table already has a static route for 10.0.0.0/8 pointing to the VPN attachment, so the issue is on the VPC side, not the TGW.

Exam trap

The trap here is that candidates often focus on the TGW route table configuration and overlook the requirement for a return route in the VPC route table, assuming that the TGW handles all routing decisions unilaterally.

How to eliminate wrong answers

Option A is wrong because the VPN attachment being in the wrong TGW route table would affect all traffic through that attachment, but the TGW route table already has a static route for 10.0.0.0/8 pointing to the VPN attachment, indicating the attachment is correctly associated. Option C is wrong because while the VPC CIDR (10.0.0.0/16) does overlap with the on-premises CIDR (10.0.0.0/8), overlapping CIDRs do not inherently break traffic; AWS TGW supports overlapping CIDRs with proper route table isolation and propagation, and the issue is specifically about missing return routing. Option D is wrong because the TGW route table does have a route for the VPC CIDR — it is propagated automatically when the VPC is attached, or can be added statically; the problem is the absence of a return route in the VPC route table, not in the TGW route table.

Practice this question →

53

Multi-Selecteasy

A company is designing a network for a three-tier web application on AWS. The web tier must be accessible from the internet, and the application and database tiers must be in private subnets. The company wants to use a single AWS Region and ensure high availability. Which TWO configurations should be implemented? (Choose two.)

Select 2 answers

A.Place an internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones.

B.Configure the web tier EC2 instances in an Auto Scaling group across two Availability Zones.

C.Use a stateful network ACL for the web tier subnets to simplify security rules.

D.Deploy a NAT Gateway in a single Availability Zone for outbound traffic from private subnets.

E.Create the VPC with a single Availability Zone to simplify management.

AnswersA, B

Provides high availability and internet access for the web tier.

Why this answer

An internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones (AZs) provides both internet access to the web tier and high availability. The ALB distributes incoming HTTP/HTTPS traffic to web instances in private subnets, and deploying across two AZs ensures fault tolerance if one AZ fails.

Exam trap

The trap here is that candidates often confuse stateless network ACLs with stateful security groups, leading them to incorrectly select option C, or they assume a single NAT Gateway is sufficient for high availability, overlooking the need for redundancy in each AZ.

Practice this question →

54

MCQmedium

A company uses AWS PrivateLink to access a SaaS application hosted in another AWS account. The SaaS provider has created a VPC endpoint service in their account. The consumer has created a VPC endpoint in their VPC. The consumer's VPC has a route table with a local route and a route to a NAT gateway. The VPC endpoint is associated with a security group that allows inbound HTTPS from the consumer's VPC CIDR. The consumer's EC2 instances can resolve the DNS name of the endpoint but cannot connect to the SaaS service. What is the most likely cause?

A.The consumer's route table routes traffic to the endpoint via the NAT gateway

B.The VPC endpoint service is not available in the consumer's Availability Zone

C.The VPC endpoint security group does not allow inbound HTTPS from the consumer's EC2 instances

D.The consumer's route table does not have a route to the VPC endpoint

AnswerD

Correct. The consumer's route table must contain a route that points traffic destined to the endpoint's service (or the endpoint's CIDR) to the VPC endpoint's ENI. Without this route, traffic may be dropped or misrouted, preventing connectivity despite successful DNS resolution.

Why this answer

For PrivateLink, the consumer's VPC endpoint is accessed via private IP addresses from the endpoint's elastic network interfaces (ENIs) in the consumer's VPC. The consumer's VPC route table must have a route to the endpoint's ENI to direct traffic correctly. The stem states that the security group allows inbound HTTPS from the consumer's VPC CIDR, so option C is not the cause.

DNS resolution works because the endpoint's DNS name resolves to the private IPs of the ENIs, but without a matching route in the route table, traffic may be dropped or misrouted. Option D is the most likely cause.

Exam trap

A common mistake is to assume that if DNS resolution works, routing is fine. However, DNS resolves to private IPs, but the route table must have a route directing traffic to the VPC endpoint's ENI. Without that route, traffic may go to the NAT gateway (if present) or be dropped.

Practice this question →

55

Multi-Selectmedium

A company has a VPC with a CIDR block of 10.0.0.0/16 and needs to establish connectivity to an on-premises network via AWS Site-to-Site VPN. The on-premises network uses a CIDR block of 192.168.0.0/16. The VPN connection will be redundant using two tunnels. Which THREE actions are required to enable this connectivity?

Select 3 answers

A.Create a Customer Gateway (CGW) in the same AWS region.

B.Create a Direct Connect virtual interface.

C.Create a Virtual Private Gateway (VGW) and attach it to the VPC.

D.Configure a NAT Gateway in the VPC.

E.Add a route in the VPC route tables pointing to the VGW for the on-premises CIDR.

AnswersA, C, E

Correct. The CGW must be created to represent the on-premises device.

Why this answer

To establish an AWS Site-to-Site VPN, three actions are required: creating a Customer Gateway (CGW), creating a Virtual Private Gateway (VGW) and attaching it to the VPC, and adding a route in the VPC route tables pointing to the VGW for the on-premises CIDR. The correct answers are A, C, and E.

Exam trap

Candidates often omit the route addition and think only the CGW and VGW are needed, but full connectivity also requires a route in the VPC route table pointing to the VGW for the on-premises CIDR.

Practice this question →

56

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network team reports intermittent connectivity loss to resources in the VPC, but the Direct Connect tunnel status shows as UP. Which configuration is MOST likely causing the issue?

A.The BGP keepalive interval is set to 60 seconds

B.Jumbo frames are enabled on the Direct Connect interface but not on on-premises routers

C.A separate private VIF is required for each VPC in the account

D.Traffic is being routed asymmetrically through the Direct Connect and a VPN backup

AnswerD

Asymmetric routing can cause connectivity issues if stateful firewalls or security groups block return traffic.

Why this answer

Asymmetric routing occurs when traffic from on-premises to the VPC uses Direct Connect, but return traffic from the VPC takes the VPN backup path. This can cause stateful firewalls (e.g., AWS Network Firewall, security groups, or on-premises firewalls) to drop packets because they expect traffic to arrive on the same interface. The Direct Connect tunnel status remains UP because the BGP session is still established, but connectivity is intermittent due to dropped return packets.

Exam trap

The ANS-C01 exam often tests the misconception that a Direct Connect tunnel status of UP guarantees end-to-end connectivity, ignoring the impact of asymmetric routing on stateful firewalls.

How to eliminate wrong answers

Option A is wrong because a BGP keepalive interval of 60 seconds is the default for Direct Connect private VIFs and does not cause intermittent connectivity loss; it would take three missed keepalives (180 seconds) to tear down the session. Option B is wrong because jumbo frames on Direct Connect are supported only for data plane traffic and do not affect BGP keepalive or tunnel status; mismatched MTU would cause packet drops for large frames, not intermittent connectivity. Option C is wrong because a single private VIF can be associated with multiple VPCs using a Direct Connect Gateway, so a separate VIF per VPC is not required.

Practice this question →

57

MCQmedium

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. They have also set up a Site-to-Site VPN as a backup. The VPC has a virtual private gateway (VGW) attached. The on-premises network uses BGP over the Direct Connect and static routes for the VPN. The network engineer notices that traffic from the VPC to on-premises is not using the Direct Connect when it is available; instead, it goes over the VPN. The VPC route table has a route for the on-premises CIDR (10.0.0.0/8) to the VGW. The VPN connection is configured with static routes. What is the MOST likely cause of this behavior?

A.The VPN static route has higher precedence than the BGP route from Direct Connect

B.The VPC route table does not have a route for the on-premises CIDR

C.The VGW is not attached to the VPC

D.The Direct Connect virtual interface is not associated with the VGW

AnswerA

Correct; static routes (from VPN) are preferred over BGP propagated routes in AWS route tables.

Why this answer

When a VPC route table has a route for the on-premises CIDR (10.0.0.0/8) pointing to the VGW, AWS uses the longest prefix match to select the route. If both the Direct Connect BGP route and the VPN static route have the same prefix length, static routes are preferred over propagated BGP routes. Therefore, the VPN static route takes precedence, causing traffic to flow over the VPN even when Direct Connect is available.

To fix this, the VPN should use BGP instead of static routes, or the static route should be removed so that the BGP route from Direct Connect is used.

Practice this question →

58

MCQmedium

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket in the same Region. Which solution provides the most secure and cost-effective connectivity?

A.Create a NAT gateway in a public subnet and add a route in the private subnet's route table pointing to the NAT gateway.

B.Create an interface endpoint for S3 in the private subnet.

C.Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet's route table.

D.Create a gateway endpoint for S3 in the VPC and add a route in the private subnet's route table pointing to the endpoint.

AnswerD

A gateway endpoint provides private, cost-effective access to S3 without internet connectivity.

Why this answer

A gateway endpoint for S3 uses Amazon's private network to connect the VPC to S3 without traversing the internet, providing the most secure and cost-effective solution. It avoids NAT gateway hourly charges and data processing fees, and it does not require public IPs or internet access for the private subnet EC2 instance.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT gateway is required for private subnet internet access, but for S3 in the same Region, a gateway endpoint is both more secure and cost-effective, and candidates may overlook the free, private connectivity option.

How to eliminate wrong answers

Option A is wrong because a NAT gateway incurs hourly charges and data processing costs, and it routes traffic over the internet, which is less secure and more expensive than a gateway endpoint. Option B is wrong because an interface endpoint for S3 is more expensive than a gateway endpoint (charges per hour and per GB processed) and is unnecessary when a gateway endpoint can serve the same purpose at lower cost. Option C is wrong because attaching an internet gateway and routing private subnet traffic through it would expose the EC2 instance to the internet, violating security best practices and still requiring a NAT device for outbound-only access, which adds cost and complexity.

Practice this question →

59

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. The VPC has a virtual private gateway (VGW) attached. The on-premises network advertises a prefix 10.0.0.0/8 over BGP. The VPC has subnets with CIDR 10.0.1.0/24 and 10.0.2.0/24. The company wants to ensure that traffic to on-premises uses Direct Connect. However, traffic to an S3 bucket uses the internet. What route configuration is required?

A.Change the VPC CIDR to avoid overlap with on-premises.

B.Add specific routes for S3 public IP prefixes pointing to the internet gateway.

C.Add a static route for 0.0.0.0/0 pointing to the internet gateway.

D.Add a static route in the VPC route table for 0.0.0.0/0 pointing to the VGW.

AnswerB

More specific routes override the general route to VGW, directing S3 traffic to IGW.

Why this answer

S3 public IP prefixes are not within the on-premises advertised prefix 10.0.0.0/8. Without explicit routes for S3, traffic to S3 would use the default route (if any) or be dropped. By adding specific routes for S3 public IP prefixes pointing to the internet gateway, S3 traffic is forced over the internet while all other traffic (including to on-premises) uses the Direct Connect private VIF via the propagated 10.0.0.0/8 route.

Exam trap

The trap is assuming that a default route (0.0.0.0/0) to the internet gateway is sufficient, but that would also send all non-matching traffic (e.g., to the internet) via IGW, which might be undesirable. The correct approach is to add specific routes for S3 public IP prefixes to the IGW, leaving the propagated 10.0.0.0/8 route for on-premises traffic.

How to eliminate wrong answers

Option A is wrong because changing the VPC CIDR to avoid overlap with on-premises does not address the requirement to route S3 traffic over the internet; it only prevents routing conflicts but does not provide a mechanism to direct S3 traffic to the internet gateway. Option C is wrong because adding a 0.0.0.0/0 route pointing to the internet gateway would send all traffic not matching a more specific route (including traffic to on-premises) to the internet, which violates the requirement that on-premises traffic uses Direct Connect. Option D is wrong because adding a 0.0.0.0/0 route pointing to the VGW would send all internet-bound traffic (including S3 traffic) through Direct Connect, which is not desired and would not allow S3 traffic to use the internet.

Practice this question →

60

MCQmedium

A company is designing a hybrid network architecture that requires high availability and low latency between its on-premises data center and AWS. They have two redundant 1 Gbps AWS Direct Connect connections. The company wants to use BGP to advertise the same prefix from both locations to AWS. How should they configure the BGP attributes to ensure active/passive failover with automatic failback?

A.Prepend the AS path on the secondary connection's BGP advertisements

B.Set a higher MED value on the primary connection's BGP advertisements

C.Set a higher local preference on the secondary connection's BGP advertisements

D.Use BGP communities to tag routes and manipulate preference on AWS side

AnswerA

AS path prepending makes the secondary path less preferred; the primary will be used, and failover/failback occurs automatically.

Why this answer

AS path prepending on the secondary connection makes the BGP path longer, causing AWS to prefer the primary connection for inbound traffic. This achieves active/passive failover: if the primary fails, the shorter AS path on the secondary becomes preferred, and automatic failback occurs when the primary recovers and its shorter AS path is re-advertised.

Exam trap

The trap here is confusing BGP attributes that influence inbound vs. outbound traffic: candidates often incorrectly apply local preference (outbound) or MED (inbound but with different semantics) instead of AS path prepending, which is the standard method for controlling inbound path selection in a multi-homed BGP setup.

How to eliminate wrong answers

Option B is wrong because setting a higher MED on the primary connection would make it less preferred, which is the opposite of the desired active/passive behavior (primary should be preferred). Option C is wrong because local preference is used to influence outbound traffic from AWS to on-premises, not inbound traffic to AWS; higher local preference on the secondary would make it preferred, contradicting the active/passive design. Option D is wrong because BGP communities can tag routes for preference manipulation on the AWS side, but this requires AWS-side policy configuration and does not directly control inbound path selection from the on-premises perspective; AS path prepending is the standard method for influencing inbound traffic without relying on AWS-side policies.

Practice this question →

61

MCQhard

A company is designing a hybrid network using AWS Direct Connect. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to configure a virtual interface (VIF) that provides connectivity to multiple VPCs in the same region. Which type of VIF should they use?

A.Hosted virtual interface

B.Public virtual interface

C.Private virtual interface

D.Transit virtual interface

AnswerD

Transit VIF connects to Transit Gateway for multiple VPCs.

Why this answer

A transit virtual interface (VIF) is the correct choice because it is specifically designed to connect a Direct Connect gateway to a single physical connection, enabling connectivity to multiple VPCs in the same or different AWS Regions. Unlike a private VIF, which only connects to a single VPC, a transit VIF works with a Direct Connect gateway and supports up to 3,000 VPC attachments per gateway, making it ideal for multi-VPC architectures.

Exam trap

The ANS-C01 exam often tests the misconception that a private VIF can connect to multiple VPCs by using a Direct Connect gateway, but the private VIF is deprecated for that use case; only a transit VIF supports the Direct Connect gateway for multi-VPC connectivity.

How to eliminate wrong answers

Option A is wrong because a hosted virtual interface is provisioned by an AWS Direct Connect Partner for use with a hosted connection, not for connecting to multiple VPCs via a Direct Connect gateway. Option B is wrong because a public virtual interface provides access to AWS public services (e.g., S3, DynamoDB) over the internet, not private connectivity to VPCs. Option C is wrong because a private virtual interface connects to a single VPC only; it does not support multiple VPCs unless you use a Direct Connect gateway, which requires a transit VIF.

Practice this question →

62

MCQeasy

A company is deploying a new application in a VPC with public and private subnets. The application needs to access an S3 bucket in the same AWS Region. Which configuration provides the MOST secure and cost-effective connectivity?

A.Configure a proxy server in the public subnet to forward requests to S3.

B.Set up an AWS Direct Connect connection to S3.

C.Create a NAT gateway in the public subnet and route traffic through it.

D.Create an S3 Gateway Endpoint in the VPC and add a route to it.

AnswerD

Gateway Endpoint provides private, free access to S3 within same Region.

Why this answer

An S3 Gateway Endpoint allows private subnet resources to access S3 over the AWS network without traversing the internet, eliminating the need for a NAT gateway or proxy. This provides the most secure connectivity (no public exposure) and is cost-effective because there are no hourly or data processing charges for the endpoint itself, only standard S3 data transfer costs.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT gateway is required for private subnet internet access, but for AWS services like S3 and DynamoDB, gateway endpoints provide a more secure and cost-effective alternative without internet egress.

How to eliminate wrong answers

Option A is wrong because a proxy server in a public subnet introduces an additional EC2 cost, management overhead, and a potential single point of failure, while still requiring traffic to traverse the internet. Option B is wrong because AWS Direct Connect is a dedicated network connection primarily for hybrid workloads and is significantly more expensive than a gateway endpoint, making it overkill for simple S3 access within the same region. Option C is wrong because a NAT gateway incurs hourly charges and data processing fees, and it routes traffic over the internet to reach S3, which is less secure and more costly than using a gateway endpoint.

Practice this question →

63

MCQeasy

A company is setting up a new VPC with both IPv4 and IPv6 support. They need to ensure that instances in a private subnet can access the Internet for software updates. Which combination of resources is required?

A.VPC endpoint and internet gateway

B.NAT gateway and egress-only internet gateway

C.NAT instance and internet gateway

D.Internet gateway and NAT gateway

AnswerB

NAT for IPv4, egress-only for IPv6.

Why this answer

For IPv6 traffic, an egress-only internet gateway allows outbound-only internet access from private subnets, while a NAT gateway provides similar functionality for IPv4 traffic. Together, they enable instances in a private subnet to initiate outbound connections to the internet for software updates without allowing inbound connections from the internet.

Exam trap

The ANS-C01 exam often tests the misconception that an internet gateway can be used for both IPv4 and IPv6 outbound-only access from private subnets, but in reality, an internet gateway allows bidirectional traffic and requires public IPs, whereas an egress-only internet gateway is specifically designed for outbound-only IPv6 traffic from private subnets.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint provides private connectivity to AWS services, not general internet access, and an internet gateway alone does not support outbound-only access from private subnets. Option C is wrong because a NAT instance can provide outbound IPv4 access, but an internet gateway does not provide outbound-only IPv6 access; an egress-only internet gateway is required for IPv6. Option D is wrong because an internet gateway is used for public subnets and would allow inbound traffic, while a NAT gateway handles IPv4 outbound traffic; this combination lacks the egress-only internet gateway needed for IPv6 outbound access.

Practice this question →

64

MCQmedium

A company is deploying an AWS Network Firewall in a centralized inspection VPC to inspect traffic between VPCs connected to an AWS Transit Gateway. The architecture uses Transit Gateway route tables to send inter-VPC traffic through the inspection VPC. The Network Firewall is configured with stateful and stateless rule groups. After deployment, the security team notices that traffic from VPC A to VPC B is being dropped. Other traffic flows correctly. What is the MOST likely cause of this issue?

A.The route table for VPC A's subnets does not have a route to the inspection VPC.

B.The stateless rule group is set to forward traffic, but the stateful rule group is not configured to allow the traffic.

C.The stateful rule group is configured to drop all traffic that is not explicitly allowed.

D.The security group attached to the Transit Gateway is blocking the traffic.

AnswerB

Correct. AWS Network Firewall processes stateless rules first. If the stateless rule group is set to forward traffic, the stateful rule group must explicitly allow it. If the stateful rule group has no matching allow rule, the traffic is dropped, which explains why only traffic from VPC A to VPC B is affected.

Why this answer

In AWS Network Firewall, stateless rule groups evaluate traffic first. If the stateless rule group is set to 'forward' (i.e., pass traffic to the stateful engine), the stateful rule group must then explicitly allow the traffic. If the stateful rule group is not configured to allow the traffic (e.g., it has no matching allow rule or has a default drop), the traffic will be dropped.

This explains why only traffic from VPC A to VPC B is dropped while other flows work, as the issue is specific to the stateful rule group's handling of that particular flow.

Exam trap

The trap here is that candidates often assume stateless rules are the sole cause of dropped traffic, overlooking that stateful rule groups have their own default actions (typically drop) that can silently block forwarded traffic, especially when the stateless rule group is set to 'forward' but the stateful rules are incomplete.

How to eliminate wrong answers

Option A is wrong because if VPC A's subnets lacked a route to the inspection VPC, no traffic from VPC A would reach the Transit Gateway or the inspection VPC, causing all traffic from VPC A to fail, not just traffic to VPC B. Option C is wrong because a stateful rule group configured to drop all traffic not explicitly allowed is a valid design; however, the question states that other traffic flows correctly, implying that the stateful rule group does allow some traffic, so the issue is not a blanket drop but rather a missing allow rule for the specific VPC A-to-VPC B flow. Option D is wrong because Transit Gateway does not have security groups; security groups are attached to ENIs (e.g., in VPCs) or to resources like EC2 instances, not to Transit Gateway attachments, so this option describes a non-existent configuration.

Practice this question →

65

MCQeasy

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download software patches from the internet. Which AWS service should be used to provide outbound internet access without allowing inbound traffic?

A.Site-to-Site VPN connection

B.VPC endpoint

D.Internet gateway

AnswerC

A NAT gateway, deployed in the public subnet with an Elastic IP, enables EC2 instances in the private subnet to initiate outbound connections to the internet for patch downloads while its stateful translation drops all unsolicited inbound traffic, satisfying the requirement for outbound-only internet access.

Why this answer

A NAT gateway enables EC2 instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., to download patches) while preventing any unsolicited inbound traffic from the internet. It resides in a public subnet with an Elastic IP and performs source network address translation (SNAT), replacing the private source IP with the gateway's public IP. This satisfies the requirement of outbound-only internet access without exposing the private instances to inbound connections.

Exam trap

The trap here is that candidates often confuse a NAT gateway with an internet gateway, thinking an internet gateway can be configured to block inbound traffic, but an internet gateway is a stateful device that inherently allows bidirectional traffic once attached to a subnet, whereas a NAT gateway explicitly prevents unsolicited inbound connections.

How to eliminate wrong answers

Option A is wrong because a Site-to-Site VPN connection establishes encrypted tunnels between the VPC and an on-premises network, not direct internet access; it does not provide a path to the public internet for patch downloads. Option B is wrong because a VPC endpoint (Gateway or Interface) provides private connectivity to AWS services (e.g., S3, DynamoDB) over the AWS network, not to the general internet; it cannot reach arbitrary internet hosts for software patches. Option D is wrong because an internet gateway allows bidirectional traffic; attaching it to a private subnet would expose the EC2 instance to inbound connections from the internet, violating the requirement to block inbound traffic.

Practice this question →

66

MCQmedium

A company has a Direct Connect connection with a public virtual interface (VIF) to access AWS public services. They want to ensure that all traffic to Amazon S3 from on-premises uses the Direct Connect connection instead of the internet. Which configuration is required?

A.Establish a VPN connection over the Direct Connect private VIF and route S3 traffic through the VPN.

B.Use the public virtual interface and configure a route filter to only accept routes for the S3 service.

C.Create a private virtual interface and attach it to the VPC.

D.Create a Direct Connect gateway and associate the public VIF with it.

AnswerB

A public VIF provides access to AWS public services, and route filters can restrict which prefixes are advertised.

Why this answer

A public virtual interface (VIF) provides direct connectivity to AWS public services, including Amazon S3, over the Direct Connect link. By default, the public VIF advertises a default route or specific AWS public prefixes; you must configure a route filter to accept only the S3 service prefixes (e.g., from the S3 service-specific prefix list) to ensure all S3 traffic uses the Direct Connect connection instead of the internet. This prevents any other public traffic from using the link and enforces the desired routing behavior.

Exam trap

The trap here is that candidates often confuse public VIFs with private VIFs, assuming a private VIF is needed for any AWS service access, or they think a VPN or Direct Connect gateway is required to secure or direct S3 traffic, when in fact a public VIF with proper route filtering is the correct and simplest solution.

How to eliminate wrong answers

Option A is wrong because establishing a VPN over a private VIF would route traffic through a VPN tunnel, adding unnecessary overhead and complexity; it does not leverage the public VIF's native access to AWS public services, and S3 traffic would still need to traverse the VPN, not the Direct Connect public path. Option C is wrong because a private virtual interface connects to a VPC for private IP communication, not to AWS public services like S3; attaching it to a VPC would not provide access to S3 endpoints. Option D is wrong because a Direct Connect gateway is used to associate private virtual interfaces with multiple VPCs or transit gateways, not to control routing for a public VIF; associating a public VIF with a Direct Connect gateway is not a supported configuration.

Practice this question →

67

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. They want to extend this connectivity to multiple VPCs in the same region without creating additional VIFs. Which solution should they implement?

A.Provision additional private VIFs for each VPC

B.Use VPC peering between the VPCs

C.Use a Transit VPC with VPN connections

D.Use a Direct Connect Gateway and attach the VPCs

AnswerD

Direct Connect Gateway enables a single VIF to connect to multiple VPCs.

Why this answer

A Direct Connect Gateway (DX Gateway) is a managed service that allows you to associate a single private virtual interface (VIF) with up to 10 VPCs in the same AWS Region (or across Regions with inter-region peering). This enables the company to extend their existing Direct Connect connection to multiple VPCs without provisioning additional VIFs, simplifying management and reducing costs.

Exam trap

The trap here is that candidates often confuse VPC peering with a Direct Connect Gateway, thinking that peering can extend the Direct Connect connection, but VPC peering does not propagate routes from the on-premises network to the peered VPCs without additional transitive routing configurations.

How to eliminate wrong answers

Option A is wrong because provisioning additional private VIFs for each VPC would increase complexity and cost, and the requirement explicitly states 'without creating additional VIFs.' Option B is wrong because VPC peering only provides connectivity between two VPCs and does not extend the Direct Connect connection to those VPCs; the on-premises network would still need a separate path to each VPC. Option C is wrong because a Transit VPC with VPN connections introduces unnecessary overhead and latency, and it does not leverage the existing Direct Connect private VIF directly; it would require additional VPN termination and routing complexity.

Practice this question →

68

MCQmedium

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in each region. They want to route users to the nearest healthy ALB using latency-based routing. Which AWS service should be used?

A.Amazon Route 53 latency-based routing

B.Amazon CloudWatch

C.VPC Traffic Mirroring

D.AWS Global Accelerator

AnswerA

Latency-based routing routes users to the region with the lowest latency.

Why this answer

Amazon Route 53 latency-based routing directs user traffic to the AWS region with the lowest network latency for the end user, based on latency measurements between the user and each region's resources. This matches the requirement to route users to the nearest healthy ALB, as Route 53 can evaluate health checks on the ALBs and only route to healthy endpoints.

Exam trap

AWS often tests the distinction between DNS-based latency routing (Route 53) and anycast-based traffic acceleration (Global Accelerator), where candidates mistakenly choose Global Accelerator because it also improves performance, but it does not perform per-request latency-based DNS routing to the nearest healthy ALB.

How to eliminate wrong answers

Option B (Amazon CloudWatch) is wrong because CloudWatch is a monitoring and observability service for collecting metrics, logs, and alarms; it does not perform DNS routing or traffic steering. Option C (VPC Traffic Mirroring) is wrong because it copies network traffic from an elastic network interface for analysis (e.g., security inspection) and has no capability to route users based on latency or health. Option D (AWS Global Accelerator) is wrong because while it uses the AWS global network and anycast IPs to improve performance, it does not use latency-based DNS routing; it relies on static anycast IPs and endpoint weights, not per-request latency measurements to the nearest healthy ALB.

Practice this question →

69

MCQeasy

A developer wants to allow an EC2 instance in a VPC to access an Amazon S3 bucket without traversing the public internet. Which AWS service should be used?

A.AWS PrivateLink with an interface VPC endpoint.

B.VPC Gateway Endpoint for S3.

C.NAT gateway in the public subnet.

D.AWS Direct Connect with a public VIF.

AnswerB

Gateway endpoints provide private access to S3 and DynamoDB.

Why this answer

A VPC Gateway Endpoint for S3 allows EC2 instances to access S3 buckets privately using AWS’s internal network, without traversing the public internet. Gateway endpoints are specifically designed for services like S3 and DynamoDB, using route table entries to direct traffic to the service via the AWS backbone, with no data transfer costs for traffic within the same region.

Exam trap

The trap here is that candidates often confuse interface VPC endpoints (PrivateLink) with gateway endpoints, assuming all AWS services require interface endpoints, but S3 and DynamoDB use gateway endpoints which are simpler and do not incur hourly costs.

How to eliminate wrong answers

Option A is wrong because AWS PrivateLink with an interface VPC endpoint is used for services that require private IP connectivity via ENIs, but S3 does not support interface endpoints in all regions and gateway endpoints are the native, cost-effective solution for S3 access. Option C is wrong because a NAT gateway in the public subnet allows outbound internet access but still routes traffic over the public internet to reach S3, failing the requirement to avoid traversing the public internet. Option D is wrong because AWS Direct Connect with a public VIF provides a dedicated connection to AWS public services, but traffic to S3 still traverses the public internet (though over the Direct Connect link), and it does not provide private, internet-free access; a private VIF would be needed for private connectivity, but that does not directly enable S3 access without additional components.

Practice this question →

70

MCQmedium

A company is implementing a hybrid network using AWS Direct Connect and VPN backup. They have multiple VPCs in a single AWS Region. Which design minimizes the number of Direct Connect virtual interfaces while providing connectivity to all VPCs?

A.Create one private VIF attached to a Direct Connect gateway and associate the gateway with all VPCs.

B.Set up a transit VPC with EC2-based routers.

C.Create a separate private VIF for each VPC.

D.Use a single public VIF and route through the internet.

AnswerA

Direct Connect gateway enables multi-VPC connectivity over one VIF.

Why this answer

A Direct Connect gateway allows a single private virtual interface (VIF) to connect to multiple VPCs in the same AWS Region. By attaching the Direct Connect gateway to all target VPCs, you eliminate the need for separate private VIFs per VPC, minimizing operational overhead and cost while maintaining private connectivity.

Exam trap

The trap here is that candidates often confuse Direct Connect gateway with transit VPC or assume that each VPC requires its own private VIF, overlooking the gateway's ability to consolidate connectivity across multiple VPCs in a single Region.

How to eliminate wrong answers

Option B is wrong because a transit VPC with EC2-based routers introduces unnecessary complexity, single points of failure, and higher latency compared to a managed Direct Connect gateway, and it still requires at least one private VIF. Option C is wrong because creating a separate private VIF for each VPC violates the goal of minimizing the number of VIFs and increases cost and management overhead. Option D is wrong because a public VIF provides access only to public AWS services (e.g., S3, DynamoDB) and cannot route traffic to private VPC CIDRs; it also forces traffic over the internet, defeating the purpose of private hybrid connectivity.

Practice this question →

71

Multi-Selecthard

A company is designing a multi-region architecture using AWS Direct Connect. Which TWO of the following are valid configurations for connecting to multiple regions? (Select TWO.)

Select 2 answers

A.Use a single Direct Connect connection to connect to all regions

B.Set up separate Direct Connect connections in each region

C.Use a Transit Gateway to connect to multiple regions

D.Use a single private VIF associated with multiple regions

E.Create a Direct Connect Gateway and associate VPCs from different regions

AnswersB, E

You can have multiple connections in different regions.

Why this answer

Each AWS Direct Connect connection is physically provisioned at a specific Direct Connect location and terminates in a single AWS region. To connect to multiple regions, you must establish separate Direct Connect connections in each target region. Option E is correct because a Direct Connect Gateway allows you to associate Virtual Private Clouds (VPCs) from different regions to a single private virtual interface (VIF), enabling inter-region connectivity over the Direct Connect connection.

Exam trap

The trap here is that candidates often confuse the regional scope of a Transit Gateway with the global scope of a Direct Connect Gateway, mistakenly thinking a Transit Gateway can directly provide multi-region connectivity over Direct Connect without additional components.

Practice this question →

72

MCQmedium

A company has deployed a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application must be accessible over the internet, but the security team requires that all traffic be inspected by a third-party firewall appliance. What is the MOST scalable architecture?

A.Configure a Network Load Balancer with target groups pointing to firewall appliances.

B.Use an EC2 instance as a transparent proxy and set it as the next-hop in the route table.

C.Use a Gateway Load Balancer with firewall appliances in each Availability Zone.

D.Deploy a single firewall appliance in one Availability Zone and route all traffic through it.

AnswerC

GWLB provides scalable, HA traffic inspection.

Why this answer

Gateway Load Load Balancer (GWLB) is designed to scale third-party virtual appliances (e.g., firewalls) horizontally across multiple Availability Zones. It uses the GENEVE protocol to encapsulate traffic, enabling transparent inspection while preserving the original packet headers. This architecture meets the security requirement for traffic inspection and provides high availability and elasticity, unlike a single appliance or a proxy-based solution.

Exam trap

The trap here is that candidates often confuse Gateway Load Balancer with Network Load Balancer, thinking an NLB can transparently insert firewalls, but only GWLB supports transparent inline traffic inspection using GENEVE encapsulation without requiring the firewall to be the destination.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer (NLB) with target groups pointing to firewall appliances would require the firewall to be the final destination or to perform NAT, breaking the transparent inspection model; GWLB is the correct service for transparent insertion of inline appliances. Option B is wrong because using an EC2 instance as a transparent proxy and setting it as the next-hop in the route table creates a single point of failure, lacks native health checking and auto-scaling, and does not scale horizontally across AZs. Option D is wrong because deploying a single firewall appliance in one Availability Zone creates a single point of failure and a scalability bottleneck; it violates the principle of high availability and cannot handle traffic for all AZs if that AZ fails.

Practice this question →

73

MCQhard

A global e-commerce company operates a production environment on AWS with a VPC (10.0.0.0/16) containing public and private subnets in three Availability Zones. The application runs on EC2 instances in private subnets behind an Application Load Balancer (ALB) in public subnets. The company uses AWS Transit Gateway to connect multiple VPCs and on-premises data centers via Site-to-Site VPN. Recently, the operations team noticed intermittent connectivity issues: users in the Asia-Pacific region experience slow page load times and occasional timeouts, while users in other regions have no issues. The network team suspects packet loss or high latency on the VPN connection to the on-premises data center in Singapore, which hosts a critical database. The AWS Direct Connect connection is not yet available. The team ran a traceroute from an EC2 instance in the production VPC to the database server (IP 203.0.113.50) and observed high latency and packet loss on the fifth hop (a transit gateway attachment). The VPN tunnel status shows 'UP' on both ends. CloudWatch metrics for the VPN tunnel show no errors but high 'TunnelData' bytes. What should the network engineer do FIRST to resolve the issue?

A.Enable jumbo frames on the transit gateway and the EC2 instances in the private subnets.

B.Increase the VPN tunnel bandwidth by creating a second VPN tunnel and enabling ECMP.

C.Modify the BGP attributes on the transit gateway to prefer the Direct Connect path once it becomes available.

D.Rebuild the VPN connection using a different customer gateway device with stronger encryption.

AnswerA

Enable jumbo frames on the transit gateway and EC2 instances to allow larger MTU, reducing fragmentation and packet loss. This is the first step to address MTU-related issues.

Why this answer

Enabling jumbo frames on the transit gateway and EC2 instances allows larger MTU, reducing packet fragmentation and the associated packet loss and latency. The high 'TunnelData' bytes and packet loss on the attachment suggest MTU mismatch. Option B is incorrect because adding a second VPN tunnel with ECMP increases bandwidth but does not fix MTU issues.

Option C is incorrect because Direct Connect is not available yet and the problem is not routing. Option D is incorrect because stronger encryption does not affect MTU.

Exam trap

Candidates might think that increasing bandwidth (option B) is the solution, but the problem is likely MTU-related packet loss, not bandwidth limitation.

Practice this question →

74

MCQeasy

A network engineer needs to allow an EC2 instance in a private subnet to access an S3 bucket without traversing the internet. Which AWS service should be used?

A.VPC Peering

B.VPC Gateway Endpoint

C.Internet Gateway

AnswerB

Gateway Endpoint allows private access to S3.

Why this answer

A VPC Gateway Endpoint allows private subnet resources to access S3 without traversing the internet by routing traffic through AWS's internal network. It uses prefix lists and route table entries to direct S3-bound traffic to a highly available, horizontally scaled gateway endpoint, avoiding NAT or internet gateway costs and latency.

Exam trap

The trap here is that candidates often confuse Gateway Endpoints with Interface Endpoints (for services like DynamoDB or API Gateway) or assume a NAT Gateway is needed for private subnet outbound traffic, missing the specific requirement to avoid internet transit for S3.

How to eliminate wrong answers

Option A is wrong because VPC Peering connects two VPCs for private IP communication, but does not provide access to AWS services like S3; it would still require a gateway or proxy to reach S3. Option C is wrong because an Internet Gateway enables internet access for public subnets, but the EC2 instance is in a private subnet and the requirement is to avoid traversing the internet entirely. Option D is wrong because a NAT Gateway allows outbound internet access from private subnets, but traffic still traverses the internet to reach S3, violating the 'without traversing the internet' constraint.

Practice this question →

75

MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs and an on-premises network via VPN. The on-premises network advertises a route for 10.0.0.0/8. One VPC has a CIDR of 10.0.1.0/24. How does Transit Gateway handle the overlapping route?

A.The Transit Gateway uses the longest prefix match; the VPC route 10.0.1.0/24 is more specific.

B.The Transit Gateway prefers the on-premises route because it is learned via BGP.

C.The Transit Gateway drops traffic to 10.0.1.0/24 due to conflict.

D.The Transit Gateway summarises the on-premises route to 10.0.0.0/16.

AnswerA

Longest prefix match determines forwarding.

Why this answer

AWS Transit Gateway uses the longest prefix match (LPM) rule to select the most specific route when multiple routes overlap. In this case, the on-premises network advertises 10.0.0.0/8 via BGP, while the VPC has a directly attached CIDR of 10.0.1.0/24. Since /24 is more specific than /8, traffic destined for 10.0.1.0/24 is routed to the VPC, not the on-premises network.

Exam trap

The trap here is that candidates assume BGP-learned routes are always preferred over directly attached VPC routes, but Transit Gateway strictly uses longest prefix match, not route source priority.

How to eliminate wrong answers

Option B is wrong because Transit Gateway does not prefer a route based solely on it being learned via BGP; it always applies longest prefix match first, regardless of route source. Option C is wrong because overlapping routes do not cause traffic to be dropped; Transit Gateway resolves conflicts by selecting the most specific prefix. Option D is wrong because Transit Gateway does not summarise or modify routes advertised by on-premises networks; it uses the exact prefix as received.

Practice this question →

Page 1 of 6 · 416 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Network Implementation questions.

Start 20-question session