NAT Gateway practice questions

Refer to the exhibit. An EC2 instance in subnet-11111 (10.0.1.0/24) cannot access the internet. The route table for the subnet is shown. What is the MOST likely cause?

Network Topology

Trap 1: The route table does not have a default route (0.0.0.0/0).

The route table shows a 0.0.0.0/0 route.

Trap 2: The VPC does not have a local route.

The local route is present.

Trap 3: The route table is not associated with the subnet.

The association shows the route table is associated with subnet-11111.

A
The route table does not have a default route (0.0.0.0/0).
Why wrong: The route table shows a 0.0.0.0/0 route.
B
The VPC does not have a local route.
Why wrong: The local route is present.
C
The route table is not associated with the subnet.
Why wrong: The association shows the route table is associated with subnet-11111.
D
The NAT gateway is not in a public subnet with an internet gateway.
NAT gateway requires a public subnet and internet gateway to function.

Question 2easymultiple choice

A startup wants to deploy a web application on AWS with a serverless architecture. The application includes static content (HTML, CSS, JS) and a REST API backend using Lambda and DynamoDB. The company wants low latency and high availability globally. Which combination of services should they use?

Trap 1: Amazon CloudFront for static content, Application Load Balancer for…

ALB is not serverless and adds cost.

Trap 2: AWS Lambda@Edge for both static content and API.

Lambda@Edge is for lightweight edge processing, not full API.

Trap 3: Amazon S3 for static content with Transfer Acceleration, and AWS…

Transfer Acceleration is for uploads, not global distribution.

A
Amazon CloudFront for static content, Application Load Balancer for API, and Lambda for compute.
Why wrong: ALB is not serverless and adds cost.
B
AWS Lambda@Edge for both static content and API.
Why wrong: Lambda@Edge is for lightweight edge processing, not full API.
C
Amazon CloudFront for static content, Amazon API Gateway for the REST API, and AWS Lambda for compute.
CloudFront provides CDN, API Gateway manages APIs, Lambda runs code serverlessly.
D
Amazon S3 for static content with Transfer Acceleration, and AWS Lambda for API.
Why wrong: Transfer Acceleration is for uploads, not global distribution.

Question 3mediummultiple choice

A company deployed the above CloudFormation template. An EC2 instance launched in the PrivateSubnet needs to access the internet for software updates. Which action is required?

Exhibit

Refer to the exhibit.
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "VPC with public and private subnets",
  "Resources": {
    "VPC": {
      "Type": "AWS::EC2::VPC",
      "Properties": {
        "CidrBlock": "10.0.0.0/16"
      }
    },
    "PublicSubnet": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "VpcId": { "Ref": "VPC" },
        "CidrBlock": "10.0.1.0/24",
        "MapPublicIpOnLaunch": true
      }
    },
    "PrivateSubnet": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "VpcId": { "Ref": "VPC" },
        "CidrBlock": "10.0.2.0/24"
      }
    }
  }
}

Trap 1: Create a VPC Peering connection to a public VPC

Peering does not provide internet access.

Trap 2: Add an Internet Gateway to the VPC and route the private subnet's…

IGW alone does not provide internet access to private instances.

Trap 3: Modify the PrivateSubnet to assign public IP addresses on launch

Public IP alone does not provide internet access; needs IGW.

A
Create a VPC Peering connection to a public VPC
Why wrong: Peering does not provide internet access.
B
Add a NAT Gateway in the PublicSubnet and update the PrivateSubnet's route table to point to the NAT Gateway
NAT Gateway enables outbound internet for private instances.
C
Add an Internet Gateway to the VPC and route the private subnet's route table to it
Why wrong: IGW alone does not provide internet access to private instances.
D
Modify the PrivateSubnet to assign public IP addresses on launch
Why wrong: Public IP alone does not provide internet access; needs IGW.

Question 4hardmultiple choice

A company is migrating a legacy monolithic application to AWS. The application uses a proprietary binary protocol over TCP. The company wants to modernize the architecture using microservices while minimizing changes to the client. Which approach should the company use?

Trap 1: Use AWS Global Accelerator with a TCP listener and endpoint groups…

Global Accelerator works with TCP/UDP but does not route to microservices based on port within a single listener.

Trap 2: Use an Application Load Balancer with path-based routing to direct…

ALB works at HTTP/HTTPS layer, not for binary TCP protocol.

Trap 3: Use Amazon API Gateway with a custom authorizer to route requests…

API Gateway requires HTTP/REST, not binary TCP.

A
Use a Network Load Balancer with TCP listener and route traffic based on destination port to different target groups.
NLB can handle TCP traffic and route based on port to different services.
B
Use AWS Global Accelerator with a TCP listener and endpoint groups for microservices.
Why wrong: Global Accelerator works with TCP/UDP but does not route to microservices based on port within a single listener.
C
Use an Application Load Balancer with path-based routing to direct traffic to separate microservices.
Why wrong: ALB works at HTTP/HTTPS layer, not for binary TCP protocol.
D
Use Amazon API Gateway with a custom authorizer to route requests to AWS Lambda functions.
Why wrong: API Gateway requires HTTP/REST, not binary TCP.

Question 5hardmulti select

A company has a data lake on Amazon S3 that is accessed by multiple business units via VPC endpoints. The security policy mandates that all access to the data lake must be encrypted in transit and originate from approved VPCs. The company has a central security account that manages AWS Network Firewall. Which combination of controls should be implemented to enforce this policy? (Choose TWO.)

Trap 1: Enable S3 Block Public Access at the account level.

Does not enforce encryption or VPC restriction.

Trap 2: Use AWS Certificate Manager to issue certificates for S3 bucket…

S3 uses TLS; certificates are not managed by ACM for S3.

Trap 3: Attach an S3 bucket policy that denies access unless the…

Allows any endpoint in those VPCs, not just approved ones.

A
Attach an S3 bucket policy that denies access unless the aws:SourceVpce condition matches the approved VPC endpoint IDs.
Correct: Restricts access to specific endpoints.
B
Enable S3 Block Public Access at the account level.
Why wrong: Does not enforce encryption or VPC restriction.
C
Configure AWS Network Firewall in the central security account to inspect traffic to the S3 endpoints and allow only encrypted traffic.
Correct: Enforces encryption and inspection.
D
Use AWS Certificate Manager to issue certificates for S3 bucket access.
Why wrong: S3 uses TLS; certificates are not managed by ACM for S3.
E
Attach an S3 bucket policy that denies access unless the aws:SourceVpc condition matches the approved VPC IDs.
Why wrong: Allows any endpoint in those VPCs, not just approved ones.

Question 6mediummultiple choice

A company is designing a new microservices architecture on AWS. Each microservice must be independently deployable and scalable. The company expects unpredictable traffic patterns with sudden spikes. Which combination of AWS services should be used to build a decoupled, resilient system?

Trap 1: Use Application Load Balancer, Amazon EC2 Auto Scaling, Amazon SQS,…

EC2 Auto Scaling has slower response to sudden spikes compared to serverless options.

Trap 2: Use Amazon API Gateway, AWS Lambda, Amazon Kinesis Data Streams,…

Kinesis is for streaming, not request-response; adding unnecessary complexity.

Trap 3: Use Application Load Balancer, Amazon ECS with Fargate, Amazon SQS,…

This option fails because Amazon RDS, despite read replicas, is a relational database that can become a shared, monolithic data store across microservices, hindering their independent deployability and scalability due to tight coupling at the data layer. The scenario explicitly requires each microservice to be independently deployable and scalable, which RDS typically obstructs. However, this combination is tempting as RDS is a robust managed database, and read replicas do enhance read performance, making it suitable for applications needing a relational backend and some read scaling, particularly for more traditional or less strictly decoupled architectures.

A
Use Amazon API Gateway, AWS Lambda, Amazon SQS, Amazon DynamoDB, and Amazon CloudWatch.
This option provides serverless, decoupled, and scalable components ideal for unpredictable spikes.
B
Use Application Load Balancer, Amazon EC2 Auto Scaling, Amazon SQS, and Amazon RDS.
Why wrong: EC2 Auto Scaling has slower response to sudden spikes compared to serverless options.
C
Use Amazon API Gateway, AWS Lambda, Amazon Kinesis Data Streams, and Amazon DynamoDB.
Why wrong: Kinesis is for streaming, not request-response; adding unnecessary complexity.
D
Use Application Load Balancer, Amazon ECS with Fargate, Amazon SQS, and Amazon RDS with read replicas.
Why wrong: This option fails because Amazon RDS, despite read replicas, is a relational database that can become a shared, monolithic data store across microservices, hindering their independent deployability and scalability due to tight coupling at the data layer. The scenario explicitly requires each microservice to be independently deployable and scalable, which RDS typically obstructs. However, this combination is tempting as RDS is a robust managed database, and read replicas do enhance read performance, making it suitable for applications needing a relational backend and some read scaling, particularly for more traditional or less strictly decoupled architectures.

Question 7mediummultiple choice

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an Amazon S3 bucket that contains sensitive data. The security team requires that all traffic between the ECS tasks and S3 remain within the AWS network and not traverse the internet. What is the MOST secure way to meet this requirement?

Trap 1: Use an internet gateway and route traffic through a NAT gateway.

Traffic would still leave the AWS network via the internet gateway.

Trap 2: Enable S3 Transfer Acceleration on the bucket.

Transfer Acceleration uses the internet.

Trap 3: Use a NAT gateway and update the route table to direct S3 traffic…

NAT gateway is for outbound internet, not private access.

A
Use an internet gateway and route traffic through a NAT gateway.
Why wrong: Traffic would still leave the AWS network via the internet gateway.
B
Enable S3 Transfer Acceleration on the bucket.
Why wrong: Transfer Acceleration uses the internet.
C
Create a VPC endpoint for S3 and attach it to the VPC.
VPC endpoint enables private connectivity to S3 without internet.
D
Use a NAT gateway and update the route table to direct S3 traffic to the NAT.
Why wrong: NAT gateway is for outbound internet, not private access.

Question 8hardmultiple choice

A company runs a containerized application on Amazon ECS with Fargate launch type. The application experiences intermittent timeouts when calling an external API. The ECS tasks are in a private subnet with a NAT gateway. How can the company improve the reliability of outbound traffic?

Trap 1: Place the tasks in a public subnet with auto-assign public IP.

Reduces security and is not recommended for production.

Trap 2: Increase the NAT gateway's bandwidth by using a larger instance…

NAT Gateway is managed; no instance type selection.

Trap 3: Use AWS Transit Gateway to route traffic through a central VPC.

Transit Gateway is for connecting multiple networks, not for NAT redundancy.

A
Place the tasks in a public subnet with auto-assign public IP.
Why wrong: Reduces security and is not recommended for production.
B
Deploy a NAT gateway in each Availability Zone and update the route tables.
Eliminates single point of failure for outbound traffic.
C
Increase the NAT gateway's bandwidth by using a larger instance type.
Why wrong: NAT Gateway is managed; no instance type selection.
D
Use AWS Transit Gateway to route traffic through a central VPC.
Why wrong: Transit Gateway is for connecting multiple networks, not for NAT redundancy.

Question 9easymultiple choice

A company has deployed a web application on Amazon ECS with Fargate. The application needs to access an Amazon RDS database. The security team mandates that the database must not be publicly accessible. What is the best way to securely connect the ECS tasks to the RDS database?

Trap 1: Use a NAT gateway to route traffic from ECS tasks to RDS.

NAT gateway is for outbound internet, not private VPC communication.

Trap 2: Attach an internet gateway to the VPC and route through it.

Internet gateway is for internet traffic, not needed for private communication.

Trap 3: Enable public accessibility on the RDS instance and restrict access…

Public accessibility violates the security requirement.

A
Use a NAT gateway to route traffic from ECS tasks to RDS.
Why wrong: NAT gateway is for outbound internet, not private VPC communication.
B
Attach an internet gateway to the VPC and route through it.
Why wrong: Internet gateway is for internet traffic, not needed for private communication.
C
Enable public accessibility on the RDS instance and restrict access to the ECS task public IP.
Why wrong: Public accessibility violates the security requirement.
D
Place the ECS tasks and RDS instance in the same VPC, and configure security groups to allow traffic on the database port.
This ensures traffic stays within the VPC.

Question 10mediummulti select

A company is designing a new serverless application that uses AWS Lambda, Amazon DynamoDB, and Amazon API Gateway. The application must handle burst traffic and cannot lose any data. The company wants to use a dead-letter queue (DLQ) for failed Lambda invocations. Which TWO services can be used as a DLQ for Lambda? (Choose two.)

Trap 1: Amazon DynamoDB Streams

DynamoDB Streams is not a DLQ.

Trap 2: Amazon Kinesis Data Streams

Kinesis is not supported as a Lambda DLQ.

Trap 3: Amazon Simple Email Service (SES)

SES is for email, not a DLQ.

A
Amazon DynamoDB Streams
Why wrong: DynamoDB Streams is not a DLQ.
B
Amazon SNS
Lambda can use SNS as a DLQ for asynchronous invocations.
C
Amazon Kinesis Data Streams
Why wrong: Kinesis is not supported as a Lambda DLQ.
D
Amazon SQS
Lambda can use SQS as a DLQ for asynchronous invocations.
E
Amazon Simple Email Service (SES)
Why wrong: SES is for email, not a DLQ.

Question 11hardmultiple choice

A company is migrating a legacy monolithic application to AWS. They plan to use Amazon ECS with Fargate for containerized microservices. The application requires sticky sessions and SSL termination. What should the company use to meet these requirements?

Trap 1: Application Load Balancer (ALB) with stickiness and SSL termination.

ALB also supports sticky sessions and SSL termination, but it is not the only option. The question asks for what should be used, and NLB is equally suitable.

Trap 2: Classic Load Balancer (CLB) with SSL termination at the instance.

Classic Load Balancer supports SSL termination at the instance, but it lacks advanced routing features and is legacy. It is not recommended for microservices.

Trap 3: AWS Lambda with API Gateway.

AWS Lambda with API Gateway is not a load balancer and cannot provide sticky sessions or SSL termination for containerized services directly.

A
Network Load Balancer (NLB) with target group stickiness.
NLB supports TLS termination and sticky sessions via target group stickiness (source IP affinity). This makes it a valid option for the requirements.
B
Application Load Balancer (ALB) with stickiness and SSL termination.
Why wrong: ALB also supports sticky sessions and SSL termination, but it is not the only option. The question asks for what should be used, and NLB is equally suitable.
C
Classic Load Balancer (CLB) with SSL termination at the instance.
Why wrong: Classic Load Balancer supports SSL termination at the instance, but it lacks advanced routing features and is legacy. It is not recommended for microservices.
D
AWS Lambda with API Gateway.
Why wrong: AWS Lambda with API Gateway is not a load balancer and cannot provide sticky sessions or SSL termination for containerized services directly.

Question 12mediummultiple choice

A company runs a production AWS Lambda function that processes orders. Recently, the function has been timing out occasionally. The function uses a VPC with a single private subnet and has a timeout of 30 seconds. What is the MOST likely cause of the timeout?

Trap 1: The function is experiencing cold starts due to high concurrency.

Cold starts add latency but not timeouts beyond the configured duration.

Trap 2: The function is hitting the maximum concurrent execution limit.

Concurrency limit causes throttling, not timeouts.

Trap 3: The function needs to be attached to a public subnet.

Lambda should not be placed in public subnets; use private subnets with NAT.

A
The function is experiencing cold starts due to high concurrency.
Why wrong: Cold starts add latency but not timeouts beyond the configured duration.
B
The function is hitting the maximum concurrent execution limit.
Why wrong: Concurrency limit causes throttling, not timeouts.
C
The function needs to be attached to a public subnet.
Why wrong: Lambda should not be placed in public subnets; use private subnets with NAT.
D
The function does not have a NAT gateway or VPC endpoints to access external resources.
Lambda in a VPC needs a route to the internet for external calls, otherwise requests hang.

Question 13hardmultiple choice

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an Amazon RDS database that is in a private subnet. The ECS tasks are launched in a public subnet. How should they configure network access?

Trap 1: Place the ECS tasks in a public subnet and use a NAT gateway to…

NAT gateway is for outbound internet, not inbound to private subnet.

Trap 2: Set up a VPN connection between the ECS tasks and the database.

VPN is unnecessary; same VPC connectivity is sufficient.

Trap 3: Use an Application Load Balancer to route traffic to the database.

ALB is for HTTP/HTTPS traffic, not database connections.

A
Launch the ECS tasks in the same private subnet as the RDS instance.
Tasks in the same subnet can communicate via security groups.
B
Place the ECS tasks in a public subnet and use a NAT gateway to route traffic to the database.
Why wrong: NAT gateway is for outbound internet, not inbound to private subnet.
C
Set up a VPN connection between the ECS tasks and the database.
Why wrong: VPN is unnecessary; same VPC connectivity is sufficient.
D
Use an Application Load Balancer to route traffic to the database.
Why wrong: ALB is for HTTP/HTTPS traffic, not database connections.

Question 14hardmultiple choice

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance does not have a public IP. What is the most secure way to provide internet access?

Trap 1: Create a VPC endpoint for the internet.

VPC endpoints are for AWS services, not general internet.

Trap 2: Launch a NAT instance in the private subnet.

NAT instance must be in public subnet.

Trap 3: Attach an Internet Gateway directly to the private subnet.

Internet Gateway requires public IPs and allows inbound traffic.

A
Create a VPC endpoint for the internet.
Why wrong: VPC endpoints are for AWS services, not general internet.
B
Launch a NAT instance in the private subnet.
Why wrong: NAT instance must be in public subnet.
C
Attach an Internet Gateway directly to the private subnet.
Why wrong: Internet Gateway requires public IPs and allows inbound traffic.
D
Add a NAT Gateway in the public subnet and update the private subnet's route table.
NAT Gateway provides outbound internet access securely.

Study the full ACL explanation →

Question 15hardmultiple choice

A company uses AWS Lambda with a VPC configuration to access an RDS database. After a recent change, the Lambda function times out when connecting to the database. The security group and network ACLs appear correct. What should the company check first?

Trap 1: That the database password has not been rotated.

Password rotation would cause authentication errors, not timeouts.

Trap 2: That the Lambda function's reserved concurrency is not set to zero.

Reserved concurrency would cause throttling, not timeouts.

Trap 3: That the Lambda function's environment variables are correctly set.

Environment variables affect configuration, not network connectivity.

A
That the database password has not been rotated.
Why wrong: Password rotation would cause authentication errors, not timeouts.
B
That the Lambda function's reserved concurrency is not set to zero.
Why wrong: Reserved concurrency would cause throttling, not timeouts.
C
That the Lambda function has a route to the database via a NAT gateway or VPC endpoint.
If the database is in a private subnet, a NAT gateway is needed for the Lambda function to access it.
D
That the Lambda function's environment variables are correctly set.
Why wrong: Environment variables affect configuration, not network connectivity.