Scenario practice questions

Which THREE of the following are valid considerations when designing a multi-Region active-active application using AWS Global Accelerator?

Trap 1: Global Accelerator supports sticky sessions (session affinity)…

Sticky sessions are not a feature of Global Accelerator.

Trap 2: Global Accelerator provides a set of static IP addresses that are…

Static IPs are anycast from the edge locations, not per-Region.

A
Global Accelerator supports sticky sessions (session affinity) based on client IP.
Why wrong: Sticky sessions are not a feature of Global Accelerator.
B
You can assign different weights to endpoints in different Regions to control traffic distribution.
Weights allow traffic splitting across endpoints.
C
Global Accelerator performs health checks on endpoints and routes traffic only to healthy endpoints.
Health checks enable automatic failover.
D
Global Accelerator can preserve the client IP address when using Network Load Balancer as an endpoint.
When using NLB, client IPs are preserved.
E
Global Accelerator provides a set of static IP addresses that are unique to each Region.
Why wrong: Static IPs are anycast from the edge locations, not per-Region.

Open the full BGP breakdown →

Question 2hardmultiple choice

A company is migrating its on-premises data center to AWS. As part of the migration, they need to establish connectivity between their on-premises network (10.0.0.0/8) and multiple VPCs in a single region. They are using AWS Transit Gateway with a Direct Connect gateway. They have two Direct Connect connections, each with a private virtual interface (VIF) to the Direct Connect gateway. The on-premises routers are configured with BGP and are advertising 10.0.0.0/8. The Transit Gateway has three VPC attachments: VPC1 (10.1.0.0/16), VPC2 (10.2.0.0/16), and VPC3 (10.3.0.0/16). All VPC attachments are in the same Transit Gateway route table, which also includes the Direct Connect gateway attachment. Initially, all VPCs can communicate with on-premises. After a maintenance window, the network team adds a new on-premises subnet (10.4.0.0/16) and updates the BGP advertisement to include 10.4.0.0/16. However, after the change, instances in VPC3 can no longer reach on-premises resources in any subnet, while VPC1 and VPC2 can still communicate with all on-premises subnets including the new one. The network engineer checks the Transit Gateway route table and sees that the route for 10.0.0.0/8 is present, pointing to the Direct Connect gateway attachment. What is the MOST likely cause of the issue?

Trap 1: The BGP advertisement for 10.4.0.0/16 exceeded the allowed prefix…

This would affect all VPCs, not just VPC3.

Trap 2: The Direct Connect gateway is not propagating routes to the Transit…

Propagation is working for other VPCs.

Trap 3: The Transit Gateway route table has a route for 10.4.0.0/16 that is…

This would only affect the new subnet, not all on-premises traffic.

A
The VPC3 subnet route tables have a static route for 10.0.0.0/8 that points to a non-existent or unavailable target
A more specific static route in the VPC route table can override the Transit Gateway route, causing blackhole.
B
The BGP advertisement for 10.4.0.0/16 exceeded the allowed prefix limit on the Direct Connect gateway
Why wrong: This would affect all VPCs, not just VPC3.
C
The Direct Connect gateway is not propagating routes to the Transit Gateway for VPC3
Why wrong: Propagation is working for other VPCs.
D
The Transit Gateway route table has a route for 10.4.0.0/16 that is blackholed
Why wrong: This would only affect the new subnet, not all on-premises traffic.

Review the full subnetting walkthrough →

Question 3easymultiple choice

A company has a VPC with a public subnet and a private subnet. The public subnet contains a web server (EC2 instance) that must be accessible from the internet. The private subnet contains a database server (EC2 instance) that should only be accessible from the web server. The web server's security group allows HTTP (80) and HTTPS (443) from 0.0.0.0/0. The database server's security group allows MySQL (3306) from the web server's security group. However, the web server cannot connect to the database server. The network engineer has verified that the web server can reach the internet and that the database server's security group is correctly configured. What is the most likely cause of the connectivity problem?

Trap 1: The route table for the private subnet does not have a route to the…

Incorrect: Route tables are not needed for traffic within the same VPC; subnets can communicate by default.

Trap 2: The web server's security group does not allow outbound traffic to…

Incorrect: Security groups are stateful; outbound traffic is allowed if inbound is allowed.

Trap 3: The database server does not have a route to the internet gateway.

Incorrect: Internet gateway is not needed for internal VPC communication.

A
The route table for the private subnet does not have a route to the public subnet.
Why wrong: Incorrect: Route tables are not needed for traffic within the same VPC; subnets can communicate by default.
B
The web server's security group does not allow outbound traffic to the database server.
Why wrong: Incorrect: Security groups are stateful; outbound traffic is allowed if inbound is allowed.
C
The network ACL associated with the private subnet is blocking inbound MySQL traffic from the web server.
Correct: A custom NACL can block traffic even if security groups allow it.
D
The database server does not have a route to the internet gateway.
Why wrong: Incorrect: Internet gateway is not needed for internal VPC communication.

Question 4hardmultiple choice

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking a suboptimal path, going through the on-premises network instead of staying within AWS. What is the most likely cause?

Trap 1: The VPCs are also peered directly, creating a conflict

VPC peering is separate; Transit Gateway routes take precedence with longest prefix match.

Trap 2: VPC Flow Logs are enabled, causing latency

Flow Logs do not affect routing.

Trap 3: Security groups are blocking direct traffic between VPCs

Security groups filter traffic, not route.

A
The Transit Gateway route table has a propagated route from the on-premises network with a longer prefix
More specific routes override default routes, sending traffic on-premises.
B
The VPCs are also peered directly, creating a conflict
Why wrong: VPC peering is separate; Transit Gateway routes take precedence with longest prefix match.
C
VPC Flow Logs are enabled, causing latency
Why wrong: Flow Logs do not affect routing.
D
Security groups are blocking direct traffic between VPCs
Why wrong: Security groups filter traffic, not route.

Question 5mediummultiple choice

A company has an AWS Lambda function that needs to access an S3 bucket in the same AWS account. The Lambda function is configured to use the VPC default execution role. The S3 bucket policy denies all principals except those explicitly allowed. The Lambda function cannot access the bucket. What should be done to resolve this issue?

Trap 1: Remove the bucket policy that denies all principals

The bucket policy can be modified to allow the Lambda role, but removing it entirely may weaken security.

Trap 2: Attach an internet gateway to the VPC and a public IP to the Lambda…

Lambda functions in a VPC can access S3 via a VPC endpoint or NAT gateway, not directly via internet gateway.

Trap 3: Create a VPC endpoint for S3 and attach it to the Lambda function's…

A VPC endpoint provides private connectivity but does not grant permissions.

A
Add an IAM policy to the Lambda execution role that allows s3:GetObject on the bucket
The Lambda execution role must have the necessary S3 permissions to access the bucket.
B
Remove the bucket policy that denies all principals
Why wrong: The bucket policy can be modified to allow the Lambda role, but removing it entirely may weaken security.
C
Attach an internet gateway to the VPC and a public IP to the Lambda function
Why wrong: Lambda functions in a VPC can access S3 via a VPC endpoint or NAT gateway, not directly via internet gateway.
D
Create a VPC endpoint for S3 and attach it to the Lambda function's VPC
Why wrong: A VPC endpoint provides private connectivity but does not grant permissions.

Read the full VPN explanation →

Question 6easymultiple choice

A network engineer is troubleshooting connectivity between an EC2 instance in a VPC and an on-premises server connected via AWS Site-to-Site VPN. The ping from the EC2 instance to the on-premises server fails. The VPN tunnel status shows 'UP'. Which configuration should the engineer check first?

Trap 1: Ensure the customer gateway device is configured with the correct…

The customer gateway is on-premises; the tunnel being up indicates the public IP is correct.

Trap 2: Check that the pre-shared key matches on both sides

If the pre-shared key didn't match, the tunnel would not be up.

Trap 3: Verify that the VPN tunnel is using the correct encryption…

The tunnel is up, so encryption settings are correct.

A
Ensure the customer gateway device is configured with the correct public IP address
Why wrong: The customer gateway is on-premises; the tunnel being up indicates the public IP is correct.
B
Check that the pre-shared key matches on both sides
Why wrong: If the pre-shared key didn't match, the tunnel would not be up.
C
Check the route table associated with the EC2 instance's subnet for a route to the on-premises network
Without a route pointing traffic to the virtual private gateway, the VPN cannot forward packets.
D
Verify that the VPN tunnel is using the correct encryption algorithms
Why wrong: The tunnel is up, so encryption settings are correct.

Review the full subnetting walkthrough →

Question 7hardmultiple choice

Refer to the exhibit. A subnet is created in VPC vpc-abcde but no explicit route table association is set. What is the default route for internet-bound traffic from this subnet?

Exhibit

Refer to the exhibit.

AWS CLI output:
{
    "RouteTables": [
        {
            "Associations": [
                {
                    "Main": true,
                    "RouteTableId": "rtb-12345",
                    "SubnetId": null
                }
            ],
            "Routes": [
                {
                    "DestinationCidrBlock": "10.0.0.0/16",
                    "GatewayId": "local",
                    "Origin": "CreateRouteTable",
                    "State": "active"
                },
                {
                    "DestinationCidrBlock": "0.0.0.0/0",
                    "NatGatewayId": "nat-67890",
                    "Origin": "CreateRoute",
                    "State": "active"
                }
            ],
            "RouteTableId": "rtb-12345",
            "VpcId": "vpc-abcde"
        }
    ]
}

Trap 1: Traffic is dropped because no explicit association is set.

The subnet uses the main route table by default.

Trap 2: Traffic goes through the Internet Gateway.

No Internet Gateway is associated.

Trap 3: Traffic is dropped because no Internet Gateway is present.

The main route table has a NAT Gateway route.

A
Traffic is dropped because no explicit association is set.
Why wrong: The subnet uses the main route table by default.
B
Traffic goes through the Internet Gateway.
Why wrong: No Internet Gateway is associated.
C
Traffic goes through the NAT Gateway nat-67890.
The main route table has a route to the NAT Gateway.
D
Traffic is dropped because no Internet Gateway is present.
Why wrong: The main route table has a NAT Gateway route.

Study the full ACL explanation →

Question 8easymultiple choice

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has created a NAT gateway in the public subnet and added a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. However, the EC2 instance cannot reach the internet. The network engineer verifies that the NAT gateway has an Elastic IP address, the security group and network ACLs allow outbound traffic, and the route table for the public subnet has a route to an internet gateway. What is the most likely cause of the issue?

Trap 1: The security group for the EC2 instance does not allow outbound…

Incorrect: The engineer verified that security groups allow outbound traffic, so this is not the issue.

Trap 2: The route table associated with the NAT gateway's subnet does not…

Incorrect: The engineer verified that the public subnet's route table has a route to the internet gateway, so this is not the issue.

Trap 3: The NAT gateway does not have an Elastic IP address assigned.

Incorrect: The engineer verified that the NAT gateway has an Elastic IP address, so this is not the issue.

A
The security group for the EC2 instance does not allow outbound traffic.
Why wrong: Incorrect: The engineer verified that security groups allow outbound traffic, so this is not the issue.
B
The route table associated with the NAT gateway's subnet does not have a route to an internet gateway.
Why wrong: Incorrect: The engineer verified that the public subnet's route table has a route to the internet gateway, so this is not the issue.
C
The route table for the private subnet does not have a route to the NAT gateway.
Correct: If the private subnet's route table does not have a route pointing 0.0.0.0/0 to the NAT gateway, traffic from the EC2 instance cannot reach the NAT gateway. Despite the engineer adding a route, it may not be correctly associated or configured.
D
The NAT gateway does not have an Elastic IP address assigned.
Why wrong: Incorrect: The engineer verified that the NAT gateway has an Elastic IP address, so this is not the issue.

Question 9hardmulti select

A company is deploying a global application and wants to use AWS Global Accelerator to improve performance. The application runs behind an Application Load Balancer (ALB) in us-east-1. Which THREE components are part of a Global Accelerator deployment?

Trap 1: Route 53 hosted zones

Route 53 is DNS, not part of Global Accelerator.

Trap 2: Lambda@Edge functions

Lambda@Edge is for CloudFront.

A
Route 53 hosted zones
Why wrong: Route 53 is DNS, not part of Global Accelerator.
B
Endpoint groups
Endpoint groups define endpoints and traffic distribution.
C
AWS edge locations
Traffic enters at edge locations.
D
Lambda@Edge functions
Why wrong: Lambda@Edge is for CloudFront.
E
Two static anycast IP addresses
Global Accelerator provides two anycast IPs.

Open the full BGP breakdown →

Question 10hardmulti select

A company uses AWS Direct Connect with a public VIF to access S3. The on-premises network uses BGP to advertise a specific prefix to AWS. The company wants to ensure that traffic to S3 from on-premises always uses the Direct Connect connection and not the internet. Which ONE configuration must be in place?

Trap 1: Set a higher MED value on routes learned from the internet to make…

MED is used for inbound traffic, not outbound.

Trap 2: Disable the internet gateway for the VPC.

The on-premises traffic doesn't go through the VPC IGW.

Trap 3: Set the AS_PATH prepend on the Direct Connect BGP session.

AS_PATH prepend makes a route less preferred, not more.

A
Set a higher MED value on routes learned from the internet to make them less preferred.
Why wrong: MED is used for inbound traffic, not outbound.
B
Set a higher local preference on the Direct Connect BGP session for the S3 prefixes.
Local preference influences outbound route selection; higher value is preferred.
C
Disable the internet gateway for the VPC.
Why wrong: The on-premises traffic doesn't go through the VPC IGW.
D
Set the AS_PATH prepend on the Direct Connect BGP session.
Why wrong: AS_PATH prepend makes a route less preferred, not more.
E
Configure the on-premises router to advertise a more specific route for the S3 CIDR blocks over the Direct Connect BGP session.
Why wrong: Incorrect. The on-premises router does not advertise S3 CIDRs; AWS advertises them over the Direct Connect public VIF. Therefore, this configuration is not valid.

Read the full VPN explanation →

Question 11hardmultiple choice

A network engineer is troubleshooting high latency on a VPN connection between an on-premises network and AWS. The VPN uses two tunnels to a virtual private gateway. The engineer notices that traffic is only using one tunnel, and the other tunnel is idle. What should the engineer do to ensure both tunnels are utilized?

Trap 1: Configure BGP MED values to prefer the idle tunnel.

MED influences path selection but does not enable active-active use; one path is still preferred.

Trap 2: Configure static routes with equal metrics on both tunnels.

Static routes do not load balance across tunnels; BGP is needed.

Trap 3: Use a transit gateway with equal cost multipath routing.

Transit gateway supports ECMP, but the issue is with a virtual private gateway, not transit gateway.

A
Create two separate site-to-site VPN connections to two different virtual private gateways and enable ECMP.
Using ECMP across multiple VPN connections allows both tunnels to be used simultaneously.
B
Configure BGP MED values to prefer the idle tunnel.
Why wrong: MED influences path selection but does not enable active-active use; one path is still preferred.
C
Configure static routes with equal metrics on both tunnels.
Why wrong: Static routes do not load balance across tunnels; BGP is needed.
D
Use a transit gateway with equal cost multipath routing.
Why wrong: Transit gateway supports ECMP, but the issue is with a virtual private gateway, not transit gateway.