VPC practice questions

A company has a centralized logging account and multiple application accounts. All VPC Flow Logs are sent to a central S3 bucket in the logging account. The security team needs to analyze the logs using Amazon Athena. The team must ensure queries are cost-effective and return results quickly for recent logs. Which configuration should be used?

Trap 1: Convert the logs to Parquet format using AWS Glue and store them in…

Parquet is good but partitioning is more impactful for recent data.

Trap 2: Use S3 lifecycle policies to transition logs to S3 Glacier after 7…

Glacier is not directly queryable by Athena.

Trap 3: Use Athena with federated query to scan logs directly from the…

Cross-account queries add complexity and latency.

A
Convert the logs to Parquet format using AWS Glue and store them in the same bucket.
Why wrong: Parquet is good but partitioning is more impactful for recent data.
B
Use S3 lifecycle policies to transition logs to S3 Glacier after 7 days and query with Athena.
Why wrong: Glacier is not directly queryable by Athena.
C
Partition the S3 bucket by date (e.g., year/month/day) and use Athena partition projection.
Correct: Partitioning reduces data scanned.
D
Use Athena with federated query to scan logs directly from the application accounts.
Why wrong: Cross-account queries add complexity and latency.

Review the full routing breakdown →

Question 2mediummultiple choice

A company is designing a cross-account network architecture. The security team requires that all traffic between VPCs in different accounts must be inspected by a centralized firewall appliance in the security account. The network team wants to minimize complexity and avoid route table manipulation. Which solution meets these requirements?

Trap 1: Use AWS PrivateLink to connect each VPC to the security VPC via…

PrivateLink is for services, not for routing all traffic.

Trap 2: Set up AWS Direct Connect gateway and route all traffic through the…

Direct Connect is for on-premises, not inter-VPC.

Trap 3: Create VPC peering connections between each VPC and the security…

Complex and scalable poorly.

A
Use AWS PrivateLink to connect each VPC to the security VPC via interface endpoints.
Why wrong: PrivateLink is for services, not for routing all traffic.
B
Set up AWS Direct Connect gateway and route all traffic through the security account.
Why wrong: Direct Connect is for on-premises, not inter-VPC.
C
Create VPC peering connections between each VPC and the security VPC, then configure route tables to route traffic through the firewall.
Why wrong: Complex and scalable poorly.
D
Use AWS Transit Gateway with a central appliance VPC, and configure route tables to send traffic to the firewall for inspection.
Correct: Centrally managed and scales well.

Question 3mediummulti select

A company is using AWS Organizations with multiple accounts. The central IT team wants to deploy a set of common VPCs in each account using AWS CloudFormation StackSets. The StackSets must be managed from the management account. Which THREE permissions are required for the StackSets to successfully deploy stacks into member accounts?

Trap 1: The management account must have an AWS Organizations SCP that…

SCPs are not required for StackSets; the necessary permissions are handled by IAM.

Trap 2: Each member account must have a self-managed IAM role named…

Self-managed roles are not required; StackSets can use service-managed permissions with automatic role creation.

A
The management account must have an IAM role (StackSetsAdminRole) with permissions to create stack instances in member accounts.
This is the admin role that assumes the execution role in member accounts.
B
The management account must have an AWS Organizations SCP that allows CloudFormation StackSets operations.
Why wrong: SCPs are not required for StackSets; the necessary permissions are handled by IAM.
C
The execution role in member accounts must have permissions to create the resources defined in the CloudFormation template (e.g., VPC, subnets).
The execution role needs permissions to actually create the resources.
D
Each member account must have a self-managed IAM role named 'AWSCloudFormationStackSetExecutionRole' with a trust policy allowing the management account to assume it.
Why wrong: Self-managed roles are not required; StackSets can use service-managed permissions with automatic role creation.
E
The management account must have permission to assume the execution role in member accounts (via IAM trust policy).
The admin role must be trusted by the execution role.

Question 4hardmultiple choice

A company has a centralized logging account that receives VPC Flow Logs from all accounts in the organization. The logs are stored in an S3 bucket. A security analyst needs to query the logs to identify traffic to a specific IP address. The analyst has been granted read-only access to the S3 bucket. However, the analyst cannot access the logs. What is the MOST likely cause?

Trap 1: The S3 bucket has a lifecycle policy that deletes logs after a…

Lifecycle policies do not affect access permissions.

Trap 2: The S3 bucket has a bucket policy that requires the analyst to…

The analyst already has read-only access; assuming a role may not be necessary.

Trap 3: The S3 bucket is encrypted with an AWS KMS key, and the analyst…

The question does not mention encryption; this is not the most likely cause.

A
The S3 bucket has a lifecycle policy that deletes logs after a short period.
Why wrong: Lifecycle policies do not affect access permissions.
B
The S3 bucket has a bucket policy that requires the analyst to assume a role in the logging account.
Why wrong: The analyst already has read-only access; assuming a role may not be necessary.
C
The S3 bucket policy includes a condition that only allows access from the logging account's AWS service principals, not from individual IAM users.
The bucket policy likely restricts access to the logging account's role, so the analyst's direct access is denied.
D
The S3 bucket is encrypted with an AWS KMS key, and the analyst does not have permissions to decrypt.
Why wrong: The question does not mention encryption; this is not the most likely cause.

Question 5mediummultiple choice

A company has a centralized networking team that manages a shared VPC with multiple AWS Transit Gateway attachments. Application teams create VPCs in separate AWS accounts and want to connect to the shared VPC. The networking team needs to ensure that only authorized VPCs can connect to the shared VPC. What is the MOST secure and scalable way to manage this?

Trap 1: Use a VPN connection from each application VPC to the shared VPC.

VPN is more complex and has bandwidth limitations.

Trap 2: Use VPC peering between the shared VPC and each application VPC.

VPC peering is not transitive and does not scale to many VPCs.

Trap 3: Create IAM roles in each application account that allow the…

This would give the networking team excessive privileges and is not scalable.

A
Use a VPN connection from each application VPC to the shared VPC.
Why wrong: VPN is more complex and has bandwidth limitations.
B
Use AWS Resource Access Manager to share the Transit Gateway with the application accounts.
RAM allows sharing the Transit Gateway, and the networking team can accept or reject attachments via RAM.
C
Use VPC peering between the shared VPC and each application VPC.
Why wrong: VPC peering is not transitive and does not scale to many VPCs.
D
Create IAM roles in each application account that allow the networking team to create VPC attachments.
Why wrong: This would give the networking team excessive privileges and is not scalable.

Question 6mediummultiple choice

A multinational corporation is migrating its on-premises Active Directory (AD) to AWS Managed Microsoft AD. The company has a hub-and-spoke VPC topology with a central transit gateway. The AD domain controllers must be deployed in two different AWS Regions for disaster recovery. The corporate security policy requires that all AD traffic between Regions must traverse the transit gateway and be inspected by a third-party firewall appliance deployed in the inspection VPC. Which architecture meets these requirements?

Trap 1: Deploy AD in two Regions and use a VPN connection between the VPCs…

VPN traffic would bypass the inspection VPC unless specifically routed, but the requirement mandates transit gateway.

Trap 2: Deploy a single AD domain in one Region and use AD replication over…

VPC peering does not support transitive routing through a third-party firewall in the transit gateway.

Trap 3: Deploy AD in two Regions, attach both VPCs to the transit gateway,…

Transit gateway peering does not support transitive routing through a third-party appliance in a different Region; traffic would go directly.

A
Deploy AD in two Regions and use a VPN connection between the VPCs to replicate data.
Why wrong: VPN traffic would bypass the inspection VPC unless specifically routed, but the requirement mandates transit gateway.
B
Deploy a single AD domain in one Region and use AD replication over a VPC peering connection to a second Region.
Why wrong: VPC peering does not support transitive routing through a third-party firewall in the transit gateway.
C
Deploy AD in two Regions, attach both VPCs to the transit gateway, and enable cross-Region transit gateway peering. Use route tables to direct AD traffic through the inspection VPC.
Why wrong: Transit gateway peering does not support transitive routing through a third-party appliance in a different Region; traffic would go directly.
D
Deploy AD in two Regions, attach both VPCs to a transit gateway in the primary Region, and use a transit gateway inter-Region peering attachment. Configure route tables to force traffic through the inspection VPC in the primary Region.
This ensures all inter-Region AD traffic is routed through the inspection VPC for firewall inspection.

Question 7mediumdrag order

Drag and drop the steps to set up a cross-region VPC peering connection in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 8hardmultiple choice

A company has attached the above bucket policy to an S3 bucket. The bucket is accessed by an application running on an EC2 instance in the same AWS account. The EC2 instance is in a private subnet and uses an S3 Gateway Endpoint (vpce-12345678) to access the bucket. The application is failing to get objects from the bucket. What is the most likely cause?

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceVpce": "vpce-12345678"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}
```

Trap 1: The application is not using the VPC endpoint

The Allow statement requires the VPC endpoint, but the Deny statement does not depend on it. If the application uses the endpoint, the Allow is satisfied, but the Deny may still block if not HTTPS.

Trap 2: The bucket policy does not allow encryption in transit

The policy does enforce HTTPS via Deny, but that is not the issue; the issue is likely that the application is not using HTTPS.

Trap 3: The application is missing the required…

No such requirement in the policy.

A
The application is not using the VPC endpoint
Why wrong: The Allow statement requires the VPC endpoint, but the Deny statement does not depend on it. If the application uses the endpoint, the Allow is satisfied, but the Deny may still block if not HTTPS.
B
The bucket policy does not allow encryption in transit
Why wrong: The policy does enforce HTTPS via Deny, but that is not the issue; the issue is likely that the application is not using HTTPS.
C
The application is using HTTP instead of HTTPS
The Deny statement blocks requests without SecureTransport, i.e., HTTP. The application may be using HTTP.
D
The application is missing the required x-amz-server-side-encryption header
Why wrong: No such requirement in the policy.

Question 9mediumdrag order

Drag and drop the steps to set up a Direct Connect private virtual interface in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 10hardmulti select

A company has a data lake on Amazon S3 that is accessed by multiple business units via VPC endpoints. The security policy mandates that all access to the data lake must be encrypted in transit and originate from approved VPCs. The company has a central security account that manages AWS Network Firewall. Which combination of controls should be implemented to enforce this policy? (Choose TWO.)

Trap 1: Enable S3 Block Public Access at the account level.

Does not enforce encryption or VPC restriction.

Trap 2: Use AWS Certificate Manager to issue certificates for S3 bucket…

S3 uses TLS; certificates are not managed by ACM for S3.

Trap 3: Attach an S3 bucket policy that denies access unless the…

Allows any endpoint in those VPCs, not just approved ones.

A
Attach an S3 bucket policy that denies access unless the aws:SourceVpce condition matches the approved VPC endpoint IDs.
Correct: Restricts access to specific endpoints.
B
Enable S3 Block Public Access at the account level.
Why wrong: Does not enforce encryption or VPC restriction.
C
Configure AWS Network Firewall in the central security account to inspect traffic to the S3 endpoints and allow only encrypted traffic.
Correct: Enforces encryption and inspection.
D
Use AWS Certificate Manager to issue certificates for S3 bucket access.
Why wrong: S3 uses TLS; certificates are not managed by ACM for S3.
E
Attach an S3 bucket policy that denies access unless the aws:SourceVpc condition matches the approved VPC IDs.
Why wrong: Allows any endpoint in those VPCs, not just approved ones.

Question 11hardmulti select

A company is designing a multi-account AWS environment using AWS Organizations. The company has several business units that each require their own VPC in shared accounts managed centrally. The company wants to enable VPC sharing to allow business units to create resources in shared subnets while maintaining network isolation. Which combination of steps should the company take to achieve this? (Choose TWO.)

Trap 1: Configure VPC endpoints in each business unit VPC to access the…

VPC endpoints are for accessing AWS services, not for inter-VPC connectivity.

Trap 2: Create VPC peering connections between the shared VPC and each…

VPC peering does not support transitive routing, making it difficult to scale.

Trap 3: Use AWS PrivateLink to connect the business unit VPCs to the shared…

PrivateLink is for accessing services, not for connecting VPCs.

A
Create a resource share in AWS Resource Access Manager (RAM) for the shared VPC subnets.
AWS RAM allows sharing subnets with other accounts in the organization.
B
Attach a transit gateway to the shared VPC and to each business unit's VPC.
A transit gateway enables transitive routing between VPCs while maintaining isolation.
C
Configure VPC endpoints in each business unit VPC to access the shared VPC.
Why wrong: VPC endpoints are for accessing AWS services, not for inter-VPC connectivity.
D
Create VPC peering connections between the shared VPC and each business unit's VPC.
Why wrong: VPC peering does not support transitive routing, making it difficult to scale.
E
Use AWS PrivateLink to connect the business unit VPCs to the shared VPC.
Why wrong: PrivateLink is for accessing services, not for connecting VPCs.

Question 12mediummultiple choice

A company's AWS environment includes multiple VPCs across several accounts that are connected via a transit gateway. The network team wants to monitor all network traffic between VPCs for security analysis. Which solution is the most scalable and cost-effective?

Trap 1: Use AWS Traffic Mirroring to mirror all traffic to a central…

High cost and complexity.

Trap 2: Enable VPC Flow Logs for each VPC and stream them to Amazon…

Logs are not centralized.

Trap 3: Place a network load balancer in each VPC and capture traffic using…

Not designed for traffic monitoring.

A
Use AWS Traffic Mirroring to mirror all traffic to a central inspection appliance.
Why wrong: High cost and complexity.
B
Enable VPC Flow Logs and publish them to a central S3 bucket, then use Amazon Athena to query the logs.
Scalable and cost-effective.
C
Enable VPC Flow Logs for each VPC and stream them to Amazon CloudWatch Logs in each account.
Why wrong: Logs are not centralized.
D
Place a network load balancer in each VPC and capture traffic using a packet sniffer.
Why wrong: Not designed for traffic monitoring.

Question 13mediummulti select

A company uses AWS Organizations and wants to centralize Amazon VPC IP Address Manager (IPAM) across multiple accounts. Which TWO steps are required to enable cross-account IPAM?

Trap 1: Create a PrivateLink endpoint for IPAM.

PrivateLink is not needed for IPAM.

Trap 2: Enable VPC sharing in each member account.

VPC sharing is for sharing subnets, not IPAM.

Trap 3: Set up AWS Direct Connect between accounts.

Direct Connect is for dedicated network connections, not for IPAM.

A
Create a PrivateLink endpoint for IPAM.
Why wrong: PrivateLink is not needed for IPAM.
B
Enable VPC sharing in each member account.
Why wrong: VPC sharing is for sharing subnets, not IPAM.
C
Share the IPAM pool using AWS Resource Access Manager (RAM).
RAM enables sharing IPAM pools across accounts.
D
Set up AWS Direct Connect between accounts.
Why wrong: Direct Connect is for dedicated network connections, not for IPAM.
E
Delegate an administrator account for IPAM.
IPAM requires a delegated administrator account.

Question 14hardmultiple choice

A company has a central logging account that receives VPC Flow Logs, CloudTrail logs, and AWS Config logs from all accounts in the organization. The logs are stored in S3 buckets. The security team wants to analyze these logs using Amazon Athena. What is the MOST cost-effective way to ensure that the Athena queries only scan the necessary data?

Trap 1: Use S3 object-level compression (e.g., gzip) to reduce data volume.

Compression reduces storage but does not reduce the amount of data scanned if partitions are not used.

Trap 2: Create AWS Glue partition indexes on the table.

Partition indexes are for faster partition retrieval, not for limiting scan size.

Trap 3: Create separate Athena tables for each account and region.

This increases maintenance and query complexity.

A
Partition the data by account ID, region, and date in the S3 bucket, and use partitions in Athena.
Partition pruning ensures Athena scans only relevant partitions.
B
Use S3 object-level compression (e.g., gzip) to reduce data volume.
Why wrong: Compression reduces storage but does not reduce the amount of data scanned if partitions are not used.
C
Create AWS Glue partition indexes on the table.
Why wrong: Partition indexes are for faster partition retrieval, not for limiting scan size.
D
Create separate Athena tables for each account and region.
Why wrong: This increases maintenance and query complexity.

Question 15hardmultiple choice

A company has multiple AWS accounts that each have their own VPCs with overlapping CIDR ranges. They want to use AWS Transit Gateway to connect these VPCs to a central network account. However, overlapping CIDRs prevent attachment. What is the MOST scalable solution?

Trap 1: Use AWS PrivateLink to connect each VPC to the network account.

PrivateLink does not solve general IP overlap for all traffic.

Trap 2: Create VPC peering connections between each VPC and the network…

Peering also requires non-overlapping CIDRs for communication.

Trap 3: Assign new non-overlapping CIDR ranges to each VPC and update all…

Re-IPing is disruptive and not scalable for many accounts.

A
Use AWS PrivateLink to connect each VPC to the network account.
Why wrong: PrivateLink does not solve general IP overlap for all traffic.
B
Create VPC peering connections between each VPC and the network account.
Why wrong: Peering also requires non-overlapping CIDRs for communication.
C
Set up a NAT gateway in each VPC and route traffic through the transit gateway using private IP addresses from a separate CIDR block.
NAT translates overlapping IPs to unique addresses, enabling communication.
D
Assign new non-overlapping CIDR ranges to each VPC and update all resources.
Why wrong: Re-IPing is disruptive and not scalable for many accounts.

Review the full routing breakdown →

Question 16easymultiple choice

A company is designing a network architecture for a multi-account AWS environment. They need to establish a central inspection VPC through which all traffic between VPCs in different accounts must pass. Which AWS service should be used to route traffic between VPCs through the inspection VPC?

Trap 1: AWS Direct Connect gateway

Direct Connect gateway is for connecting on-premises to VPCs.

Trap 2: VPC peering with full mesh connectivity

VPC peering does not support transitive routing through a central VPC.

Trap 3: Elastic Load Balancer

ELB is for distributing traffic, not routing between VPCs.

A
AWS Direct Connect gateway
Why wrong: Direct Connect gateway is for connecting on-premises to VPCs.
B
VPC peering with full mesh connectivity
Why wrong: VPC peering does not support transitive routing through a central VPC.
C
Elastic Load Balancer
Why wrong: ELB is for distributing traffic, not routing between VPCs.
D
AWS Transit Gateway
Transit Gateway supports transitive routing and central inspection VPC architectures.

Question 17mediummultiple choice

A company has a management account in AWS Organizations and wants to share a central Amazon VPC subnet with multiple member accounts for a shared services VPC. Which AWS service should be used to share the subnet?

Trap 1: VPC peering connection

VPC peering connects VPCs but does not share subnets.

Trap 2: AWS PrivateLink

PrivateLink exposes services via endpoints, not subnet sharing.

Trap 3: Service control policy

SCPs are for permissions, not resource sharing.

A
VPC peering connection
Why wrong: VPC peering connects VPCs but does not share subnets.
B
AWS Resource Access Manager
RAM allows sharing subnets across accounts within an organization.
C
AWS PrivateLink
Why wrong: PrivateLink exposes services via endpoints, not subnet sharing.
D
Service control policy
Why wrong: SCPs are for permissions, not resource sharing.

Question 18hardmultiple choice

Refer to the exhibit. A solutions architect is troubleshooting why EC2 instances launched in subnet-11111111 cannot access the internet. The subnet is in a VPC with an internet gateway attached. The route table for the subnet has a default route (0.0.0.0/0) pointing to the internet gateway. What is the MOST likely cause?

Network Topology

Trap 1: The internet gateway is not attached to the VPC

The exhibit implies it is attached.

Trap 2: The subnet needs a NAT gateway for internet access

A NAT gateway is needed for private subnets, but this subnet can be public if it assigns public IPs.

Trap 3: The subnet's route table does not have a route to the internet…

The exhibit states the route exists.

A
The subnet's auto-assign public IP setting is disabled
MapPublicIpOnLaunch is false, so instances lack public IPs.
B
The internet gateway is not attached to the VPC
Why wrong: The exhibit implies it is attached.
C
The subnet needs a NAT gateway for internet access
Why wrong: A NAT gateway is needed for private subnets, but this subnet can be public if it assigns public IPs.
D
The subnet's route table does not have a route to the internet gateway
Why wrong: The exhibit states the route exists.

Question 19hardmultiple choice

A company uses AWS Organizations and wants to implement a data perimeter across all accounts to ensure that data can only be accessed from approved networks. Which combination of controls should be used to enforce this perimeter?

Trap 1: Use S3 bucket policies with aws:SourceIp condition.

This only applies to S3, not all services.

Trap 2: Use AWS Config rules to detect and alert on non-compliant access.

Config rules only detect, not enforce.

Trap 3: Use network ACLs in each VPC.

NACLs are stateless and not centrally managed.

A
Use S3 bucket policies with aws:SourceIp condition.
Why wrong: This only applies to S3, not all services.
B
Use AWS Config rules to detect and alert on non-compliant access.
Why wrong: Config rules only detect, not enforce.
C
Use network ACLs in each VPC.
Why wrong: NACLs are stateless and not centrally managed.
D
Use service control policies with aws:SourceIp and aws:SourceVpc conditions.
SCPs can deny access from unapproved networks across all services.

Question 20mediummultiple choice

A company with multiple AWS accounts wants to centrally manage network security policies. The security team needs to inspect all traffic between VPCs in different accounts and block malicious traffic. Which solution is MOST operationally efficient?

Trap 1: AWS PrivateLink to route traffic through a centralized security…

PrivateLink is for accessing services, not for routing all inter-VPC traffic; managing appliances adds overhead.

Trap 2: VPC Peering connections between all VPCs and use security groups to…

VPC Peering does not provide centralized traffic inspection; security groups are stateful but not designed for inline inspection across many VPCs.

Trap 3: AWS Transit Gateway with a centralized inspection VPC using a…

This requires manual route table updates in each VPC and additional management of the inspection VPC.

A
AWS PrivateLink to route traffic through a centralized security appliance in a single account.
Why wrong: PrivateLink is for accessing services, not for routing all inter-VPC traffic; managing appliances adds overhead.
B
VPC Peering connections between all VPCs and use security groups to control traffic.
Why wrong: VPC Peering does not provide centralized traffic inspection; security groups are stateful but not designed for inline inspection across many VPCs.
C
AWS Network Firewall with AWS Firewall Manager and AWS Resource Access Manager to deploy across accounts.
This provides centralized policy management and automatic deployment across accounts with minimal operational effort.
D
AWS Transit Gateway with a centralized inspection VPC using a Gateway Load Balancer.
Why wrong: This requires manual route table updates in each VPC and additional management of the inspection VPC.