Courseiva

SAP-C02 · topic practice

VPC Endpoint practice questions

Practise AWS Certified Solutions Architect Professional SAP-C02 VPC Endpoint practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security
15 questionsDomain: VPC Endpoint
Practice 10 questionsBrowse domain →

What the exam tests

What to know about VPC Endpoint

IPv6 questions usually test address types (link-local, global unicast, ULA), autoconfiguration (SLAAC), Neighbor Discovery Protocol and the differences from IPv4.

IPv6 address types and their scopes (link-local, global unicast, multicast, ULA).

SLAAC vs DHCPv6 vs stateful assignment.

Neighbor Discovery Protocol replacing ARP.

IPv6 routing differences and dual-stack coexistence.

Watch out for

Common VPC Endpoint exam traps

  • ▸Link-local addresses are not routable beyond the local link.
  • ▸SLAAC uses EUI-64 or random interface IDs — not a DHCP server.
  • ▸NDP uses ICMPv6, not ARP.
  • ▸An IPv6 prefix is /64 for most host subnets, not /24.

Practice set

VPC Endpoint questions

15 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice
Read the full DNS explanation →

A company has a multi-account architecture with a central networking account that hosts a Transit Gateway. Each workload account has VPCs attached to the Transit Gateway. The company wants to centrally manage DNS resolution across all VPCs using Route 53 Resolver. They create a Route 53 Resolver outbound endpoint in the networking account and associate it with the workload VPCs via RAM. However, workload accounts cannot resolve on-premises hostnames. What is the missing configuration?

Question 2mediummultiple choice
Read the full DNS explanation →

A company has a centralized AWS account for managing Amazon Route 53 DNS. The company has 100 VPCs across multiple accounts, and each VPC needs to resolve private hosted zones in the central account. What is the most scalable solution to enable DNS resolution across accounts?

Question 3hardmultiple choice
Read the full DNS explanation →

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The directory will be used for authentication across multiple VPCs in different accounts. The company needs to ensure that resources in all VPCs can resolve DNS names from the directory. What is the MOST scalable and secure solution?

Question 4hardmulti select
Read the full VPC Endpoint explanation →

A company has a data lake on Amazon S3 that is accessed by multiple business units via VPC endpoints. The security policy mandates that all access to the data lake must be encrypted in transit and originate from approved VPCs. The company has a central security account that manages AWS Network Firewall. Which combination of controls should be implemented to enforce this policy? (Choose TWO.)

Question 5hardmultiple choice
Review the full routing breakdown →

A large enterprise has a multi-account AWS environment managed through AWS Organizations. The central networking team uses a transit gateway in a shared services VPC to connect all VPCs. The security team requires that all traffic between VPCs be inspected by a third-party firewall appliance that is deployed in an auto-scaling group in the shared services VPC. The firewall appliance is configured as a Gateway Load Balancer (GWLB) endpoint. The transit gateway has a route table that sends all inter-VPC traffic to the GWLB endpoint. Recently, the operations team noticed that some applications are experiencing high latency and packet loss when communicating across VPCs. Upon investigation, they found that the firewall appliance is not scaling properly. Which solution should be implemented to ensure that the firewall can handle the traffic load and maintain low latency?

Question 6mediummulti select
Read the full VPC Endpoint explanation →

A company is setting up a new AWS Organization and wants to implement a data perimeter to ensure that data can only be accessed from approved network locations. Which TWO actions should the company take?

Question 7mediummultiple choice
Read the full VPC Endpoint explanation →

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an Amazon S3 bucket that contains sensitive data. The security team requires that all traffic between the ECS tasks and S3 remain within the AWS network and not traverse the internet. What is the MOST secure way to meet this requirement?

Question 8hardmultiple choice
Review the full subnetting walkthrough →

A company is migrating a stateful firewall appliance to AWS. The appliance currently inspects traffic between multiple on-premises segments. In AWS, the company wants to deploy the appliance in a VPC to inspect traffic between subnets. Which architecture should the company use to ensure that the appliance can inspect all traffic?

Question 9hardmulti select
Read the full DNS explanation →

A company is migrating to a multi-account structure and needs to manage DNS resolution across accounts. The company uses Amazon Route 53 private hosted zones. They want a central resolver in the shared services VPC. Which THREE components are required?

Question 10hardmultiple choice
Review the full subnetting walkthrough →

A company has attached the above bucket policy to an S3 bucket. The bucket is accessed by an application running on an EC2 instance in the same AWS account. The EC2 instance is in a private subnet and uses an S3 Gateway Endpoint (vpce-12345678) to access the bucket. The application is failing to get objects from the bucket. What is the most likely cause?

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceVpce": "vpce-12345678"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}
```
Question 11hardmultiple choice
Read the full VPC Endpoint explanation →

A company is migrating a legacy on-premises application to AWS. The application consists of a web server, an application server, and a MySQL database. The company has already migrated the web and application servers to EC2 instances in a VPC. The database is still on-premises. The application currently connects to the database using a JDBC connection string with the on-premises IP address. The company wants to minimize changes to the application code. The network team has established an AWS Direct Connect connection between the on-premises data center and the VPC. The security team requires that traffic between the application and the database be encrypted in transit. The database is not publicly accessible. The migration plan includes moving the database to Amazon RDS for MySQL in the same VPC after the initial cutover. During the migration testing phase, the application team reports that the application can connect to the on-premises database but performance is slower than expected. CloudWatch metrics show high latency on the database connections. The application uses a connection pool with 100 connections. Which solution should the solutions architect recommend to improve performance while minimizing application code changes?

Question 12easymultiple choice
Read the full VPC Endpoint explanation →

A company uses AWS Lambda functions to process events from Amazon S3. They notice that some Lambda invocations are failing with 'ResourceNotFoundException' errors when trying to write to an Amazon DynamoDB table. The Lambda execution role has a policy that grants dynamodb:PutItem on the table. What is the most likely cause of these errors?

Question 13mediummultiple choice
Review the full subnetting walkthrough →

A company runs a production AWS Lambda function that processes orders. Recently, the function has been timing out occasionally. The function uses a VPC with a single private subnet and has a timeout of 30 seconds. What is the MOST likely cause of the timeout?

Question 14hardmultiple choice
Review the full subnetting walkthrough →

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance does not have a public IP. What is the most secure way to provide internet access?

Question 15hardmultiple choice
Study the full ACL explanation →

A company uses AWS Lambda with a VPC configuration to access an RDS database. After a recent change, the Lambda function times out when connecting to the database. The security group and network ACLs appear correct. What should the company check first?

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Sign up freeLog in

Focused VPC Endpoint sessions

Start a VPC Endpoint only practice session

Every question in these sessions is drawn from the VPC Endpoint domain — nothing else.

10 questions20 questions30 questions50 questions
Browse all VPC Endpoint questions →Mixed SAP-C02 session

Related practice questions

Related SAP-C02 topic practice pages

Move into related areas when this topic feels solid.

Design Solutions for Organizational Complexity practice questions

Practise SAP-C02 questions linked to Design Solutions for Organizational Complexity.

Design for New Solutions practice questions

Practise SAP-C02 questions linked to Design for New Solutions.

Continuous Improvement for Existing Solutions practice questions

Practise SAP-C02 questions linked to Continuous Improvement for Existing Solutions.

Accelerate Workload Migration and Modernization practice questions

Practise SAP-C02 questions linked to Accelerate Workload Migration and Modernization.

SAA-C03 VPC practice questions

Practise SAP-C02 questions linked to SAA-C03 VPC.

SAA-C03 S3 lifecycle policy questions

Practise SAP-C02 questions linked to SAA-C03 S3 lifecycle policy questions.

SAA-C03 RDS Multi-AZ questions

Practise SAP-C02 questions linked to SAA-C03 RDS Multi-AZ questions.

SAA-C03 IAM policy practice questions

Practise SAP-C02 questions linked to SAA-C03 IAM policy.

SAA-C03 Route 53 failover questions

Practise SAP-C02 questions linked to SAA-C03 Route 53 failover questions.

SAA-C03 CloudFront practice questions

Practise SAP-C02 questions linked to SAA-C03 CloudFront.

SAA-C03 NAT gateway questions

Practise SAP-C02 questions linked to SAA-C03 NAT gateway questions.

SAA-C03 VPC endpoint questions

Practise SAP-C02 questions linked to SAA-C03 VPC endpoint questions.

Frequently asked questions

What does the SAP-C02 exam test about VPC Endpoint?
IPv6 questions usually test address types (link-local, global unicast, ULA), autoconfiguration (SLAAC), Neighbor Discovery Protocol and the differences from IPv4.
How should I use these practice questions?
Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just VPC Endpoint questions in a focused session?
Yes — the session launcher on this page draws every question from the VPC Endpoint domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other SAP-C02 topics?
Use the topic links above to move to related areas, or go back to the SAP-C02 question bank to see all topics.
Are these real exam questions or dumps?
These are original practice questions written to test the same concepts the SAP-C02 exam covers. They are not copied from any real exam or dump site.