Knowledge + Practice

CCNA Networking and Content Delivery Questions

52 questions · Networking and Content Delivery · All types, answers revealed

Practice these questions Domain overview All questions

1

MCQhard

Refer to the exhibit. A security group is attached to an Application Load Balancer (ALB) that serves HTTPS traffic on port 443. Users can access the application via HTTPS. However, the ALB's health checks to targets on port 80 are failing. What is the reason?

A.The ALB's security group does not allow HTTPS traffic from the internet.

B.The security group for the target instances does not allow HTTP traffic from the ALB's security group.

C.The ALB's security group does not allow HTTP traffic from the target's IP range.

D.The health check is configured to use HTTPS, but the target only supports HTTP.

AnswerB

This is correct because the ALB sends health check requests from its own network interfaces, using the ALB's security group as the source in the allowed inbound rule on each target. The target instance's security group must explicitly allow inbound TCP on the health check port (HTTP/80) from the ALB's security group ID (or from the VPC CIDR if the security group reference is not used). Without that rule, the OS receives the SYN packet but the security group silently drops it, so the health check times out and the target is marked unhealthy. This is the standard root cause for healthy-app-turned-unhealthy after an ALB change or when targets are in a different security group.

Why this answer

The ALB's security group allows inbound HTTPS from anywhere (0.0.0.0/0) on port 443, and inbound HTTP from the VPC CIDR (10.0.0.0/16) on port 80. Health checks originate from the ALB's private IP addresses, which are within the VPC CIDR. Therefore, the ALB's security group is correctly configured.

The health checks fail because the target instances' security group does not allow inbound HTTP traffic from the ALB's security group. When the target's security group lacks a rule permitting traffic from the ALB's security group, the health check requests are blocked. Option A is incorrect because the ALB's security group does allow HTTPS from the internet.

Option C is incorrect because the ALB's security group allows HTTP from the VPC CIDR, which includes the target's IP range. Option D is incorrect because health checks are configured on port 80 (HTTP), not HTTPS.

Practice this question →

2

MCQhard

Instances in a private subnet need outbound internet access for software updates. The route table sends 0.0.0.0/0 to a NAT gateway, but updates fail. Which condition should you check first?

A.Confirm the NAT gateway is in a public subnet whose route table has 0.0.0.0/0 to an internet gateway.

B.Attach an internet gateway directly to the private subnet instances.

C.Replace all security groups with network ACLs.

D.Enable VPC peering to another account.

AnswerA

Without an IGW route from the NAT gateway subnet, outbound internet access fails.

Why this answer

A NAT gateway must reside in a public subnet with a route table entry directing 0.0.0.0/0 to an internet gateway (IGW). Without this, the NAT gateway cannot translate private IPs to the IGW's public IP, so outbound traffic from private instances fails. This is the most common root cause for failed internet access through a NAT gateway.

Exam trap

The trap here is that candidates assume any subnet with a NAT gateway automatically has internet access, overlooking the requirement that the NAT gateway itself must be in a public subnet with a default route to an internet gateway.

How to eliminate wrong answers

Option B is wrong because attaching an internet gateway directly to a private subnet is not supported; an IGW can only be attached to a VPC and associated with public subnets, and private subnet instances lack public IPs to use it directly. Option C is wrong because replacing security groups with network ACLs does not solve the routing issue; NACLs are stateless and can filter traffic, but they do not provide internet connectivity. Option D is wrong because VPC peering does not provide internet access; it only enables private connectivity between VPCs, and does not route traffic to the internet.

Practice this question →

3

MCQmedium

A company has two Amazon VPCs (VPC-A and VPC-B) in the same AWS Region with non-overlapping CIDR blocks. The SysOps administrator needs to establish private IP connectivity between the two VPCs with high throughput and minimal cost. Which solution should the administrator implement?

A.VPC Peering

B.AWS Transit Gateway

C.AWS VPN CloudHub

D.AWS Direct Connect

AnswerA

VPC peering allows private connectivity between two VPCs using AWS's private network. It is simple to set up, has no bandwidth limitations, and incurs no hourly cost. It is the most cost-effective solution for connecting two VPCs in the same region.

Why this answer

VPC Peering is the correct solution because it allows direct private IP connectivity between two VPCs in the same AWS Region using the AWS global network backbone, with no bandwidth bottlenecks, no single point of failure, and no additional cost beyond data transfer charges. Since the VPCs have non-overlapping CIDR blocks, they can be peered without route conflicts, and traffic flows entirely within AWS without traversing the public internet or requiring a transit hub.

Exam trap

The trap here is that candidates often over-engineer the solution by choosing AWS Transit Gateway for its centralized routing features, forgetting that for a simple two-VPC peering scenario with non-overlapping CIDRs, VPC Peering is the most cost-effective and high-performance option without the overhead of a transit hub.

How to eliminate wrong answers

Option B (AWS Transit Gateway) is wrong because it introduces unnecessary complexity and cost (hourly per-attachment charges and data processing fees) for a simple two-VPC scenario where VPC Peering provides the same high throughput at lower cost. Option C (AWS VPN CloudHub) is wrong because it requires VPN connections over the public internet, which adds latency, reduces throughput, and incurs hourly VPN connection charges, making it less performant and more expensive than VPC Peering. Option D (AWS Direct Connect) is wrong because it is designed for hybrid connectivity between on-premises networks and AWS, not for VPC-to-VPC communication, and involves significant setup costs, long lead times, and monthly port fees that are unnecessary for this use case.

Practice this question →

4

MCQhard

A SysOps Administrator manages a VPC with public and private subnets. The private subnets need to access the internet for software updates. The Administrator creates a NAT Gateway in a public subnet and updates the private subnet route table to point 0.0.0.0/0 to the NAT Gateway. However, instances in the private subnet still cannot reach the internet. What is the MOST likely reason?

A.The security group on the private instances blocks outbound HTTPS traffic.

B.The internet gateway is not attached to the NAT Gateway.

C.The NAT Gateway does not have an Elastic IP address assigned.

D.The NAT Gateway's security group is blocking inbound traffic from the private subnet.

AnswerC

A NAT Gateway requires an Elastic IP to communicate with the internet; without one, it cannot route traffic.

Why this answer

A NAT Gateway must have an Elastic IP (EIP) address assigned to it in order to function as an internet gateway for private subnets. Without an EIP, the NAT Gateway cannot communicate with the internet. Option A is unlikely because security groups allow outbound traffic by default.

Option B is incorrect because the internet gateway attaches to the VPC, not to the NAT Gateway. Option D is incorrect because NAT Gateways do not have security groups; they use network ACLs at the subnet level, but the issue here is the missing EIP.

Practice this question →

5

MCQhard

A company has a VPC with public and private subnets. The private subnets need outbound internet access to download software updates while preventing any inbound internet traffic. The SysOps administrator must minimize costs. Which solution should the administrator implement?

A.Create a NAT Gateway in a public subnet and update the private subnet route table to use it

B.Launch a NAT instance in a public subnet with an Elastic IP and disable source/destination check, then update private subnet route tables

C.Attach an Internet Gateway to the VPC and add a default route to the Internet Gateway in the private subnets

D.Use AWS Transit Gateway with a VPN connection to an on-premises data center for internet access

AnswerB

Launching a NAT instance is the correct cost-minimizing solution because it uses a regular EC2 instance, which incurs only standard instance-hour charges and no per-gigabyte data processing fees, unlike a NAT Gateway. To make it work, you must assign an Elastic IP so the NAT instance has a stable public address, disable the source/destination check so the instance can forward traffic, and update the private subnet route tables to point 0.0.0.0/0 at the NAT instance's private IP. This configuration provides outbound internet access for private instances while preserving the cost advantage over the managed gateway service.

Why this answer

A NAT instance, when launched in a public subnet with an Elastic IP and source/destination check disabled, can route outbound traffic from private subnets to the internet while blocking unsolicited inbound connections. This solution minimizes costs compared to a NAT Gateway, as NAT instances use existing EC2 instance pricing and can be further reduced with spot instances or smaller instance types.

Exam trap

The trap here is that candidates often choose the NAT Gateway (Option A) because it is fully managed and simpler, overlooking the explicit cost-minimization requirement that favors the cheaper, self-managed NAT instance.

How to eliminate wrong answers

Option A is wrong because a NAT Gateway incurs hourly charges and data processing fees, making it more expensive than a NAT instance, which is contrary to the requirement to minimize costs. Option C is wrong because attaching an Internet Gateway directly to private subnets and adding a default route would expose those subnets to inbound internet traffic, violating the security requirement to prevent inbound traffic. Option D is wrong because AWS Transit Gateway with a VPN connection to an on-premises data center is over-engineered and costly for simple outbound internet access, and it does not directly provide internet access without additional routing and infrastructure.

Practice this question →

6

MCQhard

A SysOps Administrator is configuring a VPC with a public subnet and a private subnet. The public subnet has an Internet Gateway. An EC2 instance in the private subnet needs to access an S3 bucket. What is the MOST secure way to provide this access?

A.Attach an Internet Gateway to the private subnet.

B.Create a VPC Gateway Endpoint for S3 in the private subnet's route table.

C.Use a VPC peering connection to an S3 bucket.

D.Create a NAT Gateway in the public subnet and route traffic through it.

AnswerB

Correct because a Gateway Endpoint provides secure, private access to S3.

Why this answer

A VPC Gateway Endpoint for S3 allows instances in a private subnet to access S3 privately without traversing the internet, using AWS's internal network. This is the most secure method as it avoids exposing the private subnet to the public internet or requiring a NAT Gateway, and it leverages AWS PrivateLink for direct, low-latency connectivity.

Exam trap

The trap here is that candidates often confuse VPC Gateway Endpoints with Interface Endpoints or assume a NAT Gateway is required for all outbound traffic, not realizing that S3 can be accessed privately via a Gateway Endpoint without internet connectivity.

How to eliminate wrong answers

Option A is wrong because attaching an Internet Gateway to a private subnet would make it public, defeating the purpose of a private subnet and exposing the EC2 instance to the internet, which is less secure. Option C is wrong because VPC peering connects VPCs, not to an S3 bucket; S3 is a regional service, not a VPC resource, and peering does not provide direct access to S3. Option D is wrong because a NAT Gateway in the public subnet would route traffic through the internet to reach S3, which is less secure and incurs additional costs compared to a VPC Gateway Endpoint that keeps traffic within the AWS network.

Practice this question →

7

MCQhard

An organization has a VPC with public and private subnets. The private subnets need to access the internet for software updates. A NAT gateway is deployed in a public subnet and the private subnet route table has a route for 0.0.0.0/0 pointing to the NAT gateway. However, instances in the private subnet cannot reach the internet. What could be the issue?

A.The NAT gateway's subnet does not have a route to an internet gateway

B.The private subnet's network ACL blocks outbound HTTPS traffic

C.The security group attached to the NAT gateway does not allow outbound traffic

D.The private instances do not have a public IP address assigned

AnswerA

For the NAT gateway to successfully forward traffic from private subnets to the internet, the subnet where the NAT gateway resides must have a route to an internet gateway (IGW). Without a route to the IGW in that subnet's route table, the NAT gateway cannot send or receive traffic from the internet, even though it has a public Elastic IP. This is the most common reason for failed outbound internet access from private instances when a NAT gateway is present.

Why this answer

The NAT gateway must be in a public subnet with a route table that includes a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, because the IGW is the only way to reach public IP addresses. The question states the NAT gateway is deployed in a public subnet, but if that subnet's route table lacks the IGW route, outbound traffic from the NAT gateway will fail.

Exam trap

The trap here is that candidates assume placing a NAT gateway in a 'public subnet' automatically gives it internet access, but the subnet must have a route table entry pointing 0.0.0.0/0 to an internet gateway for the NAT gateway to function.

How to eliminate wrong answers

Option B is wrong because a network ACL (NACL) is stateless and would need to block both outbound HTTPS (port 443) and the corresponding inbound ephemeral return traffic; however, the default NACL allows all traffic, and the question does not indicate any custom NACL changes, so this is unlikely the root cause. Option C is wrong because security groups are stateful and are attached to resources like EC2 instances, not to NAT gateways; NAT gateways do not have security groups, so this option is technically invalid. Option D is wrong because instances in a private subnet do not need public IP addresses; they rely on the NAT gateway's public IP for outbound internet access, so the absence of a public IP on the private instances is not the issue.

Practice this question →

8

MCQeasy

A SysOps administrator needs to allow traffic from a specific IP address range (203.0.113.0/24) to access an Amazon EC2 instance in a VPC. Which configuration step should be performed?

A.Create an IAM policy that allows inbound traffic from 203.0.113.0/24.

B.Add a rule to the network ACL associated with the subnet to allow inbound traffic from 203.0.113.0/24.

C.Modify the route table of the subnet to include a route for 203.0.113.0/24 to the internet gateway.

D.Add an inbound rule to the security group associated with the EC2 instance allowing traffic from 203.0.113.0/24.

AnswerD

A security group is a stateful, instance-level virtual firewall that filters traffic at the elastic network interface. Adding an inbound rule that permits 203.0.113.0/24 on the desired port allows that specific source to reach the EC2 instance, and because security groups are stateful, the return traffic is automatically allowed without any additional outbound rule. This provides the most precise and correct method for the stated requirement.

Why this answer

Security groups act as a virtual firewall for EC2 instances, allowing you to specify inbound rules to permit traffic from specific IP ranges like 203.0.113.0/24. Option A is incorrect because IAM policies manage permissions for AWS actions, not network traffic filtering. Option B is incorrect because network ACLs provide stateless filtering at the subnet level, but security groups are more appropriate for instance-level control and are stateful.

Option C is incorrect because route tables control the direction of outbound traffic and do not restrict inbound access to instances.

Practice this question →

9

MCQmedium

A company runs an application across multiple Availability Zones. The application servers are in private subnets and need outbound internet access to download software updates and patches. The SysOps administrator needs a highly available, fully managed solution to provide this outbound connectivity. Which solution should be used?

A.Deploy a NAT instance in each private subnet

B.Deploy a single NAT Gateway in one public subnet

C.Deploy a NAT Gateway in each public subnet

D.Attach an Internet Gateway directly to the private subnets

AnswerC

By deploying a NAT Gateway in each Availability Zone's public subnet and configuring private subnets to use the NAT Gateway in the same AZ, the solution is both fully managed and highly available. If one AZ fails, the other AZ's NAT Gateway continues to provide internet access.

Why this answer

Deploying a NAT Gateway in each public subnet provides a highly available, fully managed solution for outbound internet access from private subnets. NAT Gateways are managed by AWS, automatically scale, and are resilient within an Availability Zone; using one per AZ ensures that if one AZ fails, the others continue to provide outbound connectivity. This meets the requirement for high availability without the operational overhead of managing NAT instances.

Exam trap

The trap here is that candidates often confuse NAT Gateways with NAT instances or assume a single NAT Gateway is sufficient for high availability, overlooking the need for one per Availability Zone to achieve true fault tolerance.

How to eliminate wrong answers

Option A is wrong because NAT instances are self-managed EC2 instances that require manual patching, scaling, and failover configuration, which contradicts the 'fully managed' requirement and introduces a single point of failure if only one instance is used per subnet. Option B is wrong because a single NAT Gateway in one public subnet creates a single point of failure; if that Availability Zone becomes unavailable, all private subnets lose outbound internet access, violating the high availability requirement. Option D is wrong because attaching an Internet Gateway directly to private subnets would expose those subnets to inbound internet traffic, defeating the purpose of a private subnet and violating security best practices; Internet Gateways are designed for public subnets only.

Practice this question →

10

MCQmedium

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to connect to an on-premises network using a site-to-site VPN. The on-premises network uses 10.0.0.0/16 as well. Which solution avoids routing conflicts?

A.Attach an Internet Gateway and use public IPs for communication.

B.Set up a second VPN connection to a different virtual private gateway.

C.Create a VPC peering connection between the VPC and on-premises network.

D.Use a NAT instance to translate addresses for overlapping ranges.

AnswerD

NAT can translate overlapping IPs.

Why this answer

A NAT instance can translate the overlapping IP addresses from the on-premises network (10.0.0.0/16) to a different IP range within the VPC, allowing communication without routing conflicts. The NAT instance performs destination NAT (DNAT) for inbound traffic and source NAT (SNAT) for outbound traffic, effectively hiding the overlap. This is a common workaround when both networks use the same CIDR block and cannot be renumbered.

Exam trap

The trap here is that candidates often assume a second VPN connection or VPC peering can solve overlapping CIDR issues, but AWS requires unique, non-overlapping IP ranges for both VPN route propagation and VPC peering, making NAT the only viable option among the choices.

How to eliminate wrong answers

Option A is wrong because attaching an Internet Gateway and using public IPs does not resolve the routing conflict within the VPC; the VPC's route tables still have a local route for 10.0.0.0/16, which will conflict with the on-premises route, and traffic destined for the on-premises network would be incorrectly routed locally. Option B is wrong because setting up a second VPN connection to a different virtual private gateway does not address the overlapping CIDR; both VPN connections would still require unique, non-overlapping IP ranges for the route tables, and the conflict persists. Option C is wrong because VPC peering does not support overlapping CIDR blocks; AWS explicitly prohibits peering connections between VPCs with overlapping or identical IP ranges, and on-premises networks cannot be peered directly with a VPC.

Practice this question →

11

MCQeasy

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to connect to an on-premises network with a CIDR of 10.0.0.0/8. What is the issue?

A.The on-premises CIDR is private and cannot be used with AWS.

B.AWS does not support /8 CIDR blocks.

C.The CIDR blocks overlap, causing routing conflicts.

D.The VPC CIDR is too large.

AnswerC

The VPC CIDR block 10.0.0.0/16 and an on-premises CIDR that also uses part of the 10.0.0.0/16 range overlap. When you establish a VPN connection or AWS Direct Connect between the VPC and the on-premises network, overlapping CIDRs create ambiguous routing: the VPC route table cannot determine whether traffic for those IPs should go to the local network or the on-premises network, so traffic may be dropped or misrouted. AWS does not allow overlapping CIDRs for VPC peering or for VPN/Direct Connect connections, so you must redesign the IP addressing to avoid overlap.

Why this answer

Overlapping CIDR blocks prevent VPC peering or VPN connections because routes conflict. Option A is not the issue. Option B is not the primary issue.

Option D is not directly a problem.

Practice this question →

12

MCQhard

A company has a VPC with multiple subnets. The SysOps administrator wants to ensure that EC2 instances in a private subnet can access Amazon S3 without going through a NAT Gateway or internet gateway. Which solution meets this requirement?

A.Set up a NAT Gateway in a public subnet and route traffic through it.

B.Create a VPC Gateway Endpoint for S3.

C.Use S3 Transfer Acceleration.

D.Create a VPC Interface Endpoint for S3.

AnswerB

Gateway Endpoint provides private access to S3.

Why this answer

A VPC Gateway Endpoint for S3 allows EC2 instances in a private subnet to access S3 privately without needing a NAT Gateway or internet gateway. Option A is incorrect because a NAT Gateway requires an internet gateway and does not provide private access. Option C is incorrect because S3 Transfer Acceleration is for faster transfers over the internet, not private connectivity.

Option D is incorrect because although a VPC Interface Endpoint can also provide private access to S3, the Gateway Endpoint is the recommended solution for S3 due to lower cost and simpler configuration.

Practice this question →

13

MCQmedium

Users are intermittently reporting 502 Bad Gateway errors when accessing the application through an Application Load Balancer. The team needs to identify which target IPs are associated with the failures and the request processing time for those requests. Application logs on instances do not capture failures before the ALB connection. What should be enabled?

A.Enable ALB access logs, specify an S3 bucket destination, and query the logs to filter on elb_status_code=502

B.Enable AWS X-Ray on the ALB to trace each request end-to-end from client to target

C.Configure a VPC Flow Log on the subnets containing the ALB to capture all network traffic

D.Install an agent on the application instances that logs all incoming connection attempts from the ALB

AnswerA

Access logs capture every ALB request including 502s. Each log entry contains the target_ip:target_port field identifying which instance handled (or failed to handle) the request, and request_processing_time and target_processing_time values for performance analysis. This data is available without any changes to instance-side software.

Why this answer

ALB access logs capture detailed information about each request, including the target IP address, request processing time, and the HTTP status code returned by the ALB. By enabling these logs and querying for `elb_status_code=502`, you can identify which target IPs were associated with the failures and the `request_processing_time` for those requests. This directly addresses the need to correlate failures with specific targets and timing, without relying on application instance logs that miss pre-connection failures.

Exam trap

The trap here is that candidates often confuse ALB access logs with VPC Flow Logs or X-Ray, assuming any logging mechanism that captures network traffic or traces will include HTTP-level details like status codes and request processing times, but only ALB access logs provide the specific fields needed to correlate 502 errors with target IPs and timing.

How to eliminate wrong answers

Option B is wrong because AWS X-Ray traces requests end-to-end, but it requires the application to be instrumented with the X-Ray SDK and does not capture failures that occur before the ALB establishes a connection to the target (e.g., connection timeouts or TLS handshake failures that result in a 502). Option C is wrong because VPC Flow Logs capture metadata about network traffic (source/destination IP, ports, protocol, and packet counts) but do not include HTTP status codes, request processing times, or ALB-specific error codes like 502. Option D is wrong because installing an agent on the application instances would only log connection attempts that reach the instance; it would not capture failures that occur before the ALB successfully connects to the target (e.g., connection refused or health check failures), which are the very failures causing the 502 errors.

Practice this question →

14

MCQhard

An EC2 instance in the subnet associated with the network ACL above cannot receive HTTP traffic (port 80) from the internet. The instance has a security group allowing HTTP inbound. What is the cause?

A.The NACL allows HTTP inbound on rule 300, but the outbound rule does not allow the return traffic

B.The NACL inbound rule for HTTP is using the wrong protocol (6 instead of 17)

C.The NACL has a deny all rule (rule 400) that blocks all inbound traffic, overriding the allow rules

D.The security group does not allow HTTP inbound

AnswerC

Rule 400 denies all inbound traffic, so even though rule 300 allows HTTP, it is overridden.

Why this answer

Network ACLs are stateless and rules are evaluated in order by rule number. Rule 400 denies all inbound traffic, and since it has a higher rule number than rules 100 and 300, it is evaluated later and overrides the allows. Rule 400 denies all inbound traffic, so HTTP (port 80) is denied.

Option A is wrong because rule 300 allows port 80 inbound from 0.0.0.0/0, so HTTP is allowed by that rule, but rule 400 denies all. Option B is wrong because the outbound rule allows all traffic. Option D is wrong because the security group allows HTTP inbound but the NACL blocks it.

Practice this question →

15

MCQmedium

A company has an Amazon VPC with public and private subnets across two Availability Zones. The company hosts a web application on EC2 instances in the private subnets. The application needs to access an Amazon S3 bucket to upload and download files. The SysOps administrator must ensure that traffic to S3 does not traverse the internet and minimizes data transfer costs. Which solution should the administrator implement?

A.Create an S3 VPC Gateway Endpoint in the VPC and associate it with the route tables of the private subnets.

B.Create an S3 VPC Interface Endpoint in the VPC and associate it with the security groups of the private subnets.

C.Set up a NAT Gateway in the public subnets and add a route to the private subnets' route tables pointing to the NAT Gateway for S3 traffic.

D.Use AWS PrivateLink with an S3 endpoint service hosted in a different VPC.

AnswerA

Gateway Endpoints provide private connectivity to S3 at no additional cost (only standard data transfer rates apply). By adding a route for the S3 prefix list to the private subnet route tables, traffic destined for S3 is routed through the endpoint.

Why this answer

An S3 VPC Gateway Endpoint provides a private, cost-effective connection to S3 from within the VPC without traversing the internet. By associating the endpoint with the route tables of the private subnets, traffic destined for S3 is routed directly through AWS's internal network, avoiding data transfer costs and internet egress charges.

Exam trap

The trap here is that candidates often confuse Gateway Endpoints with Interface Endpoints, assuming both are equally suitable for S3, but Gateway Endpoints are free and optimized for S3 and DynamoDB, while Interface Endpoints incur costs and are better for other AWS services.

How to eliminate wrong answers

Option B is wrong because an S3 VPC Interface Endpoint uses AWS PrivateLink with an elastic network interface, incurring per-hour and per-GB data processing costs, which is more expensive than a Gateway Endpoint and unnecessary for S3 access. Option C is wrong because a NAT Gateway routes traffic through the internet to reach S3, incurring data transfer costs and internet egress charges, violating the requirement to avoid internet traversal. Option D is wrong because AWS PrivateLink with an S3 endpoint service hosted in a different VPC is not a standard or supported method for accessing S3; S3 Gateway Endpoints are designed for direct VPC-to-S3 connectivity without cross-VPC complexity.

Practice this question →

16

Multi-Selecthard

Which THREE components are required to set up a site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)

Select 3 answers

A.Virtual private gateway

B.Internet gateway

C.VPN connection

D.Customer gateway

E.Direct Connect virtual interface

AnswersA, C, D

AWS-side endpoint for the VPN.

Why this answer

A virtual private gateway (VGW) is the VPN concentrator on the AWS side of a site-to-site VPN connection. It attaches to the VPC and terminates the IPsec tunnels from the on-premises network. Without a VGW, the VPC has no endpoint to receive encrypted traffic from the customer gateway.

Exam trap

The trap here is that candidates confuse an internet gateway with a virtual private gateway, thinking any gateway can serve as a VPN endpoint, but only the VGW supports IPsec termination and route propagation for site-to-site VPNs.

Practice this question →

17

MCQeasy

EC2 instances in private subnets need to access S3 buckets. Currently the instances use a NAT Gateway to reach S3 over the internet. The team wants to keep S3 traffic private (within the AWS network) and reduce NAT Gateway data processing costs. What is the correct solution?

A.Create an S3 Gateway VPC endpoint and add it to the private subnet's route table; S3 traffic will bypass the NAT Gateway

B.Create an S3 Interface VPC endpoint in the private subnet to route S3 traffic privately

C.Add a route in the private subnet's route table directing all traffic (0.0.0.0/0) to an Internet Gateway

D.Use S3 Transfer Acceleration to route traffic over AWS edge locations instead of NAT

AnswerA

After the Gateway endpoint is created and the route table updated, the AWS networking layer automatically routes S3 API calls from instances in those subnets through the private endpoint path. The NAT Gateway processes zero S3 bytes, eliminating the per-GB data processing cost for S3 traffic. No code changes are required.

Why this answer

An S3 Gateway VPC endpoint allows EC2 instances in private subnets to access S3 privately using AWS’s internal network, bypassing the NAT Gateway entirely. This eliminates NAT data processing costs and keeps traffic within the AWS backbone, as the endpoint is added to the private subnet’s route table with a prefix list for S3, directing traffic directly to S3 without internet routing.

Exam trap

The trap here is that candidates confuse Gateway VPC endpoints with Interface VPC endpoints, assuming both incur costs, but S3 Gateway endpoints are free and designed specifically for S3 and DynamoDB, while Interface endpoints are for other AWS services and have associated charges.

How to eliminate wrong answers

Option B is wrong because an S3 Interface VPC endpoint uses AWS PrivateLink with an elastic network interface in the subnet, incurring hourly charges and per-GB data processing costs, which does not reduce costs compared to a NAT Gateway and is unnecessary for S3 access when a Gateway endpoint (free of charge) is available. Option C is wrong because adding a route directing all traffic (0.0.0.0/0) to an Internet Gateway would expose private instances directly to the internet, violating security requirements and not keeping traffic private within AWS. Option D is wrong because S3 Transfer Acceleration uses AWS edge locations and the public internet to speed up uploads, but it does not keep traffic private within the AWS network and still requires internet connectivity, failing to reduce NAT Gateway costs.

Practice this question →

18

MCQmedium

A SysOps administrator needs to ensure that all traffic to an Amazon S3 bucket is encrypted in transit. Which configuration should be used?

A.Use Amazon CloudFront with the S3 bucket as origin and require HTTPS.

B.Create a VPC endpoint for S3 and route all traffic through it.

C.Enable default encryption on the S3 bucket.

D.Add a bucket policy that denies requests where aws:SecureTransport is false.

AnswerD

This bucket policy explicitly denies any request for which the aws:SecureTransport condition is false, meaning the request was not made over HTTPS or TLS. Because a deny in an identity-based or bucket policy overrides any allows, every request must present a valid TLS connection or it will be rejected. This enforces encryption in transit at the S3 bucket level for all clients, including those using the public endpoint, and is the standard method for ensuring HTTPS-only access.

Why this answer

A bucket policy with a condition that denies requests when aws:SecureTransport is false (i.e., HTTP) enforces HTTPS for all access to the S3 bucket. Option A is incorrect because CloudFront with HTTPS only encrypts traffic between the viewer and CloudFront, not necessarily between CloudFront and S3 unless configured, and it does not enforce HTTPS for direct S3 access. Option B is incorrect because a VPC endpoint for S3 uses private IPs but does not enforce encryption in transit; it can still use HTTP.

Option C is incorrect because default encryption on an S3 bucket only encrypts data at rest, not in transit.

Exam trap

Candidates often confuse encryption at rest (e.g., S3 default encryption) with encryption in transit. The correct mechanism for enforcing HTTPS is a bucket policy with the `aws:SecureTransport` condition.

Practice this question →

19

Multi-Selecteasy

A SysOps administrator needs to ensure high availability for a web application running on EC2 instances across multiple Availability Zones. Which TWO actions should the administrator take?

Select 2 answers

A.Launch EC2 instances in at least two different Availability Zones.

B.Place a CloudFront distribution in front of the instances.

C.Launch all EC2 instances in a single Availability Zone for consistency.

D.Register the instances with an Application Load Balancer that has health checks enabled.

E.Attach an EBS volume to each instance and replicate data in real-time.

AnswersA, D

Distributing instances across AZs provides fault tolerance.

Why this answer

Options A and D are correct. Launching EC2 instances across multiple Availability Zones (A) provides fault isolation, and registering them with an Application Load Balancer that has health checks enabled (D) ensures traffic is routed only to healthy instances. Option B is incorrect because CloudFront is a CDN, not a load balancer; it improves performance but does not directly provide high availability by health checking instances.

Option C is incorrect because all instances in a single Availability Zone creates a single point of failure. Option E is incorrect because EBS volumes are tied to a specific Availability Zone and real-time replication does not address instance-level failures across zones.

Practice this question →

20

Multi-Selectmedium

Which TWO actions can be taken to improve the availability of a web application hosted on EC2 instances behind an Application Load Balancer? (Select two.)

Select 2 answers

A.Configure an Auto Scaling group with health checks to replace unhealthy instances.

B.Use larger EC2 instance types.

C.Deploy the EC2 instances across multiple Availability Zones.

D.Use a single AWS Region for all instances.

E.Place all EC2 instances in a single subnet.

AnswersA, C

Auto Scaling automatically replaces unhealthy instances.

Why this answer

An Auto Scaling group with health checks can automatically replace unhealthy EC2 instances, improving availability. Option C is correct because deploying instances across multiple Availability Zones provides fault tolerance; if one AZ fails, your application continues to run in another. Option B is incorrect because using larger instance types improves performance, not availability.

Option D is incorrect because using a single region makes the application vulnerable to region-wide failures, reducing availability. Option E is incorrect because placing all instances in a single subnet creates a single point of failure; distributing across AZs is necessary for high availability.

Practice this question →

21

MCQmedium

A company hosts a web application behind an Application Load Balancer (ALB) in us-east-1. Users in Europe report high latency. The SysOps administrator decides to use AWS Global Accelerator to improve performance by directing traffic to the closest edge location. However, the application logs require the original client IP addresses of users. The ALB currently provides the client IP via the X-Forwarded-For header, but the development team warns that Global Accelerator may change the source IP. Which configuration should the administrator choose to meet both performance and logging requirements?

A.Configure Global Accelerator with an endpoint group that points directly to the ALB. The ALB will continue to receive the original client IP in the X-Forwarded-For header.

B.Place a Network Load Balancer (NLB) in front of the ALB, and configure Global Accelerator to point to the NLB. The NLB preserves the client IP, and the ALB can still see it in the X-Forwarded-For header.

C.Enable Proxy Protocol v2 on the ALB to ensure client IP addresses are preserved through Global Accelerator.

D.Use Amazon CloudFront instead of Global Accelerator and configure it to forward the client IP in a custom header.

AnswerB

Global Accelerator preserves the client source IP when the endpoint is an NLB. The NLB passes traffic to the ALB, which can see the original client IP in the X-Forwarded-For header. This satisfies both performance (using Global Accelerator) and logging requirements.

Why this answer

Placing a Network Load Balancer (NLB) in front of the ALB allows Global Accelerator to terminate the TCP connection at the edge, then forward traffic to the NLB. The NLB preserves the original client IP address by default (since it operates at Layer 4 and does not terminate the connection), and the ALB can still read the client IP from the X-Forwarded-For header. This setup meets both the performance requirement (via Global Accelerator's edge routing) and the logging requirement (preserving the original client IP).

Exam trap

The trap here is that candidates assume Global Accelerator preserves the client IP like a transparent proxy, but in reality it terminates the TCP connection at the edge, so the source IP changes unless an NLB is used to preserve it.

How to eliminate wrong answers

Option A is wrong because Global Accelerator terminates the TCP connection at the edge location and then creates a new connection to the ALB, so the source IP seen by the ALB becomes the Global Accelerator's internal IP, not the original client IP; the X-Forwarded-For header will contain the Global Accelerator's IP, not the user's IP. Option C is wrong because Proxy Protocol v2 is a feature of Network Load Balancers and TCP listeners, not Application Load Balancers; ALBs do not support Proxy Protocol v2, and enabling it on the ALB would not preserve client IP through Global Accelerator. Option D is wrong because CloudFront does not preserve the original client IP in the X-Forwarded-For header by default; it adds the CloudFront edge IP as the last entry, and while you can forward a custom header, this requires additional configuration and does not guarantee the original client IP is preserved in the same way as the NLB+ALB solution.

Practice this question →

22

MCQmedium

A company has an on-premises data center connected to AWS via an AWS Direct Connect private virtual interface (VIF). The SysOps administrator needs to ensure that all traffic between the on-premises network and Amazon S3 in the same AWS Region stays within the AWS network and does not traverse the internet. Which solution should the administrator implement?

A.Use a Direct Connect gateway and a public VIF with a route to S3 prefix lists

B.Use a Direct Connect gateway and a private VIF with VPC endpoints for S3

C.Use a VPN connection over Direct Connect to access S3

D.Use a Transit Gateway with a private VIF and route S3 traffic through a NAT instance

AnswerB

A private VIF creates a dedicated private network connection between your on-premises data center and a VPC, while a VPC Gateway Endpoint for S3 privately connects the VPC to S3 without traversing the internet. Traffic from on-premises flows via the private VIF into the VPC and then through the Gateway Endpoint directly to S3 over AWS's internal network, successfully meeting the requirement for high-bandwidth, fully private S3 access. This is the recommended AWS architecture for private S3 connectivity over Direct Connect.

Why this answer

A private VIF with VPC endpoints for S3 (Gateway Endpoints) ensures that traffic from on-premises to S3 stays within the AWS network. The private VIF provides connectivity to the VPC, and the Gateway Endpoint routes S3 traffic through the AWS backbone without traversing the internet. This combination meets the requirement of keeping traffic within the AWS network.

Exam trap

The trap here is that candidates often confuse public VIF with private VIF, thinking a public VIF is required for AWS service access, but Gateway Endpoints allow private VIF to access S3 without internet exposure.

How to eliminate wrong answers

Option A is wrong because a public VIF with a route to S3 prefix lists would still route traffic over the public internet (via the Direct Connect public VIF), which does not guarantee that traffic stays within the AWS network; it also requires routing over the internet gateway. Option C is wrong because a VPN connection over Direct Connect would encrypt traffic but still uses the public VIF or internet path, and it does not inherently keep traffic within the AWS network; it adds unnecessary complexity and does not meet the requirement of staying within the AWS network. Option D is wrong because a Transit Gateway with a private VIF and routing S3 traffic through a NAT instance would force traffic through a NAT instance, which typically uses an internet gateway to reach S3, thus traversing the internet; this violates the requirement.

Practice this question →

23

MCQmedium

A company has two Amazon VPCs: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16) in the same AWS Region. The SysOps administrator needs to enable private IP connectivity between the two VPCs without using the public internet. The solution must be simple, low-cost, and provide high throughput. Which AWS service should the administrator use?

A.VPC peering

B.AWS Site-to-Site VPN

C.AWS Direct Connect

D.AWS Transit Gateway

AnswerA

VPC peering establishes a direct, private network connection between two VPCs using the AWS backbone. It is simple to set up, has low cost (no hourly fees, only data transfer charges), and provides high throughput with no bandwidth constraints.

Why this answer

VPC peering is the correct choice because it enables direct private IP connectivity between two VPCs using the AWS global network, without requiring internet gateways, VPNs, or physical connections. It is simple to set up (no additional hardware or software), low-cost (no per-hour charges, only data transfer costs), and provides high throughput (bandwidth is limited only by the instance types, not by the peering connection itself).

Exam trap

The trap here is that candidates often over-engineer the solution by choosing AWS Transit Gateway (Option D) for its advanced features, forgetting that for a simple two-VPC connection, VPC peering is the most cost-effective and straightforward option without unnecessary complexity.

How to eliminate wrong answers

Option B (AWS Site-to-Site VPN) is wrong because it requires a virtual private gateway on each VPC and an on-premises VPN endpoint, adding complexity and cost (per-hour charges) while throughput is limited by the VPN tunnel (typically up to 1.25 Gbps per tunnel). Option C (AWS Direct Connect) is wrong because it is designed for dedicated on-premises to AWS connectivity, not for VPC-to-VPC peering, and involves high cost, long provisioning times, and physical infrastructure. Option D (AWS Transit Gateway) is wrong because while it can connect multiple VPCs, it introduces additional cost (per-hour and per-GB charges) and complexity (requires transit gateway attachments and route table management) that is unnecessary for a simple two-VPC scenario.

Practice this question →

24

MCQeasy

A company has multiple on-premises branch offices, each with a site-to-site VPN connection to a single VPC in AWS. The SysOps administrator needs to enable communication between the branch offices using the AWS cloud as a hub. Which configuration should be implemented to achieve this with the least operational overhead?

A.Configure static routes in the VPC route table pointing to each VPN connection.

B.Use dynamic routing (BGP) on all VPN connections and enable route propagation on the virtual private gateway (VGW).

C.Create a separate Transit VPC with EC2-based VPN appliances to route traffic between branch offices.

D.Place all branch offices in the same IPsec tunnel by configuring identical pre-shared keys.

AnswerB

Configuring BGP on every Site-to-Site VPN connection and enabling route propagation on the VPC route table for the virtual private gateway (VGW) allows the VGW to automatically exchange route information between all attached VPN connections. Each branch's BGP session advertises its local CIDRs, and those routes are installed into the VPC route table via route propagation, so traffic from one branch to another is forwarded through the VGW without manual entries. This is the native AWS mechanism for a hub-and-spoke setup where the VPC is the hub and branch offices are spokes, enabling dynamic, self-updating inter-branch communication.

Why this answer

Enabling dynamic routing (BGP) on all VPN connections and propagating routes from the virtual private gateway (VGW) into the VPC route table allows each branch office to learn the CIDR blocks of all other branch offices automatically. This eliminates the need for manual static route entries and ensures that traffic between branch offices is routed through the VPC hub with minimal operational overhead, as BGP handles failover and route updates dynamically.

Exam trap

The trap here is that candidates often assume static routes are simpler and sufficient for hub-and-spoke communication, overlooking that BGP route propagation on the VGW provides automated, scalable route exchange with minimal ongoing management, which is the key to reducing operational overhead.

How to eliminate wrong answers

Option A is wrong because configuring static routes in the VPC route table pointing to each VPN connection would require manual updates whenever a branch office subnet changes or a VPN connection is added/removed, increasing operational overhead and not scaling well. Option C is wrong because creating a separate Transit VPC with EC2-based VPN appliances introduces significant complexity, cost, and maintenance overhead compared to using the native VGW with BGP route propagation. Option D is wrong because placing all branch offices in the same IPsec tunnel by configuring identical pre-shared keys is not a valid configuration; each site-to-site VPN connection must have unique tunnel settings, and this approach would cause routing conflicts and security issues, not enable inter-branch communication.

Practice this question →

25

MCQeasy

Refer to the exhibit. A SysOps Administrator runs the above command and sees that an EC2 instance is unhealthy. The health check is configured to check the HTTP endpoint '/health' on port 80. The instance's security group allows inbound HTTP traffic from the ALB's security group. What is the MOST likely cause?

A.The instance is not associated with the target group.

B.The application on the instance is not configured to respond to the '/health' path.

C.The target group is configured to use port 8080 instead of port 80.

D.The security group on the instance does not allow inbound traffic from the ALB.

AnswerB

Correct. The health check endpoint '/health' is not properly handled by the application, causing the health check to fail.

Why this answer

The health check path is '/health', but the application on the instance might not have that endpoint configured, causing the health check to fail. Option A is incorrect because the instance is associated with the target group; otherwise it would not appear in the health check results. Option C is incorrect because the target group is configured to use port 80, as stated in the scenario.

Option D is incorrect because the security group on the instance does allow inbound HTTP traffic from the ALB's security group, as stated in the scenario.

Practice this question →

26

MCQhard

A SysOps administrator is configuring an Application Load Balancer to route traffic to multiple target groups based on the URL path. The ALB is not routing traffic correctly. Which listener rule configuration should be used to route requests with path /api/* to target group A and all other requests to target group B?

A.Create a rule with a host header condition matching 'api.example.com' and forward to target group A, and a default rule forward to target group B.

B.Create one rule with a condition that matches /api/* and forward to target group A, and another condition in the same rule for /* to forward to target group B.

C.Create a rule with path pattern /api/* and forward to target group A with priority 10, and a default rule with path pattern /* and forward to target group B with priority 20.

D.Create two rules with path patterns /api/* and /*, and set priority based on the pattern length.

AnswerC

Correct. Path pattern /api/* matches requests starting with /api/, and the default rule with /* catches all others. Priority determines evaluation order; higher priority rules are evaluated first.

Why this answer

The ALB listener rules are evaluated in order; the first rule with a path pattern /api/* will match, and then a default rule (catch-all) is needed for all other paths. Option A is incorrect because order is not automatically prioritized by pattern. Option B is incorrect because a single rule cannot have two conditions with different paths to different target groups.

Option D is incorrect because while both rules with path patterns are valid, the priority must be explicitly set; the ALB does not automatically prioritize based on pattern length.

Practice this question →

27

MCQmedium

A company has an Application Load Balancer (ALB) in the us-east-1 region. Users in Asia report high latency. The SysOps administrator wants to use AWS Global Accelerator to improve performance by directing traffic to the closest edge location. Which step is required to integrate Global Accelerator with the ALB?

A.Create a CloudFront distribution and point it to the ALB as an origin.

B.Configure the ALB as an endpoint group in a Global Accelerator accelerator.

C.Set up a Route 53 geoproximity routing policy for the ALB.

D.Use AWS WAF to allow traffic from Global Accelerator edge locations.

AnswerB

Global Accelerator is a networking service that provides two static anycast IP addresses at AWS edge locations and routes traffic over the AWS global network to the ALB endpoint. By adding the ALB as an endpoint in an endpoint group for the us-east-1 region, user traffic from Asia enters the AWS backbone at the nearest edge and traverses the private, low-latency AWS network instead of the congested public internet. This also brings health checking, automatic failover, and consistent performance even during internet disruptions.

Why this answer

AWS Global Accelerator uses the AWS global network to route traffic to the closest edge location, then forwards it over the AWS backbone to the ALB endpoint. To integrate, you must configure the ALB as an endpoint in an endpoint group within the accelerator, which allows Global Accelerator to direct traffic to the ALB based on proximity and health. This reduces latency for users in Asia by minimizing internet hops.

Exam trap

The trap here is that candidates often confuse Global Accelerator with CloudFront or Route 53 routing policies, assuming any CDN or DNS-based solution can achieve the same latency reduction, but Global Accelerator uniquely provides static IP addresses and optimized network pathing without caching or DNS caching delays.

How to eliminate wrong answers

Option A is wrong because CloudFront is a content delivery network (CDN) optimized for caching static and dynamic content, not for TCP/UDP traffic acceleration to an ALB; it adds unnecessary complexity and does not provide the anycast IP-based global acceleration that Global Accelerator offers. Option C is wrong because Route 53 geoproximity routing is a DNS-based routing policy that can direct users to different endpoints based on geographic location, but it does not provide the static anycast IP addresses or the optimized network path that Global Accelerator uses to reduce latency; DNS-based routing is also subject to client-side caching and does not offer the same performance improvements. Option D is wrong because AWS WAF is a web application firewall that filters HTTP/S traffic based on rules, not a mechanism to integrate or allow traffic from Global Accelerator edge locations; Global Accelerator automatically handles traffic routing without requiring WAF configuration for integration.

Practice this question →

28

MCQeasy

A company hosts a static website on Amazon S3. Users access the website from around the world. The SysOps administrator needs to deliver content with low latency and support HTTPS with a custom domain. Which AWS service should be used?

A.AWS Global Accelerator

B.Amazon CloudFront

C.Amazon Route 53 latency-based routing

D.S3 Transfer Acceleration

AnswerB

CDN with edge caching, HTTPS, and custom domain support.

Why this answer

Amazon CloudFront is a content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for global users. It natively supports HTTPS with custom domains via SSL/TLS certificates from AWS Certificate Manager (ACM) and integrates with S3 as an origin. This combination of low-latency delivery and HTTPS termination makes CloudFront the correct choice for this scenario.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator with CloudFront because both improve performance, but Global Accelerator does not cache content or terminate HTTPS for static websites, making it unsuitable for this use case.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator improves TCP/UDP traffic performance using the AWS global network but does not cache content or terminate HTTPS for static website delivery; it is designed for dynamic applications, not static content caching. Option C is wrong because Amazon Route 53 latency-based routing only directs DNS queries to the region with the lowest latency, but it does not cache content or provide HTTPS termination; the origin S3 bucket would still serve content directly without edge caching. Option D is wrong because S3 Transfer Acceleration speeds up uploads to S3 using edge locations, but it does not cache content for downloads, does not support custom domain HTTPS, and is intended for large object uploads, not global static website delivery.

Practice this question →

29

Multi-Selecthard

A company is using Amazon Route 53 as its DNS service. The SysOps team needs to route traffic to multiple resources based on the geographic location of the users. Which TWO routing policies can achieve this? (Select TWO.)

Select 2 answers

A.Geoproximity routing

B.Simple routing

C.Failover routing

D.Latency-based routing

E.Geolocation routing

AnswersA, E

Geoproximity routing uses the geographic location of both the user and the AWS resource to route traffic, and it supports an optional bias value that expands or shrinks the route-to-resource region. For example, you can set a positive bias to direct more traffic to a specific AWS Region, or a negative bias to move traffic away from it. This makes it ideal for gradually shifting traffic between regions while still basing routing on physical proximity.

Why this answer

The question asks for two routing policies that route traffic based on geographic location. Geoproximity routing (Option A) and Geolocation routing (Option E) are the correct choices. Geoproximity routing considers both geographic location and optional bias, while Geolocation routing uses strict geographic boundaries.

Latency-based routing (Option D) routes based on network latency, not geography, even if latency often correlates with distance. Simple routing (Option B) and Failover routing (Option C) do not use geographic information at all.

Exam trap

The question asks for two geographic routing policies, but only Geoproximity routing and Geolocation routing are based on geographic location. Candidates might mistakenly think there is a third correct option, such as latency-based routing, but that uses network latency, not geography. This can cause confusion.

Practice this question →

30

MCQmedium

A SysOps administrator is configuring a VPC with a public subnet and a private subnet. The private subnet needs to access the internet to download patches. The administrator creates a NAT Gateway in the public subnet and updates the private subnet route table. However, instances in the private subnet cannot reach the internet. What is the most likely cause?

A.The network ACL for the private subnet blocks outbound traffic.

B.The route table for the public subnet does not have a route to an Internet Gateway.

C.The NAT Gateway does not have an Elastic IP address attached.

D.The security group associated with the NAT Gateway blocks outbound traffic.

AnswerB

This is correct: the public subnet's route table must have a route to an Internet Gateway for the NAT Gateway to send traffic to the internet.

Why this answer

The most likely cause is that the route table associated with the public subnet does not have a route to an Internet Gateway. A NAT Gateway must be placed in a public subnet, and that subnet's route table must have a default route (0.0.0.0/0) pointing to an Internet Gateway for the NAT Gateway to connect to the internet. Without this route, the NAT Gateway cannot send traffic to the internet.

Options A, C, and D are incorrect: (A) While network ACLs can impact traffic, the scenario suggests the issue is routing, not ACLs; (C) NAT Gateways do require an Elastic IP, but if the administrator created the NAT Gateway, they likely attached one; (D) Security groups do not apply to NAT Gateways, as they are managed AWS services.

Practice this question →

31

MCQhard

A company is using an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The security team reports that the ALB is receiving a high number of requests with suspicious User-Agent strings. The SysOps team needs to block these requests at the load balancer level without changing the application code. Which action should be taken?

A.Modify the security group of the ALB to deny traffic from User-Agent strings.

B.Update the target group health check to filter out suspicious User-Agent strings.

C.Add a listener rule on the ALB that checks the User-Agent header and returns a fixed response.

D.Deploy AWS WAF and associate it with the ALB.

AnswerC

ALB listener rules can evaluate header conditions such as User-Agent at the application layer. By configuring a rule that matches specific User-Agent patterns and setting the action to 'Return fixed response' with a 403 status, the ALB blocks those requests before they reach target instances. This approach avoids modifying application code and directly uses the ALB's built-in routing capabilities, making it the most efficient and load-balancer-level solution.

Why this answer

ALB listener rules can evaluate conditions like the User-Agent header and perform actions such as returning a fixed response, which effectively blocks requests. Option A is incorrect because security groups operate at the network layer and cannot inspect HTTP headers; they filter traffic based on IP addresses and ports. Option B is incorrect because target group health checks determine instance health and do not filter incoming requests based on headers.

Option D is incorrect because while AWS WAF can inspect headers and block requests, it is a separate service that adds complexity and cost; the question asks for an action at the load balancer level, and ALB rules provide a simpler direct solution.

Practice this question →

32

Multi-Selectmedium

A SysOps administrator is designing a highly available web application across multiple AWS regions. The application uses an Application Load Balancer in each region. Which TWO services can be used to route traffic to the closest regional load balancer based on latency?

Select 2 answers

A.AWS Global Accelerator

B.Amazon Route 53 geoproximity routing

C.Amazon Route 53 weighted routing

D.Amazon Route 53 latency-based routing

E.Amazon CloudFront with origin groups

AnswersA, D

Global Accelerator uses Anycast IPs, not latency routing.

Why this answer

For routing traffic to the closest regional load balancer based on latency, two appropriate services are AWS Global Accelerator (option A) and Amazon Route 53 latency-based routing (option D). AWS Global Accelerator uses anycast IPs to direct users to the nearest edge location, then routes traffic over the AWS global network to the closest regional load balancer, providing latency-based routing. Amazon Route 53 latency-based routing directs traffic to the AWS region with the lowest latency for the user.

Geoproximity routing (option B) routes based on geographic location, not primarily latency. Weighted routing (option C) distributes traffic by weight, and CloudFront with origin groups (option E) is for failover and content delivery, not latency-based routing.

Practice this question →

33

MCQmedium

A company uses Amazon CloudFront to deliver content from an Application Load Balancer (ALB) origin. The SysOps administrator needs to restrict access to the content so that only users from a specific geographic location can view it. Which CloudFront feature should be used?

A.Geographic restrictions (geo-blocking) in CloudFront

B.Origin Access Identity (OAI)

C.Signed URLs

D.AWS WAF web ACL associated with the CloudFront distribution

AnswerA

CloudFront's native geo-restriction feature allows you to configure an allowlist or blocklist of two-letter ISO country codes directly in the distribution's settings. When a viewer in a denied country requests content, CloudFront's edge locations reject the request with an HTTP error before it ever reaches the origin. This works at the edge, requires no code or additional AWS services, and precisely matches the requirement of restricting access by geographic location. Because this feature is built into CloudFront itself, it is the correct choice among the options.

Why this answer

CloudFront's geographic restrictions (geo-blocking) feature allows you to restrict access to content based on the geographic location of the viewer's IP address. This is the simplest and most direct method to ensure only users from a specific country or region can access the content delivered through CloudFront, without requiring any changes to the origin or additional authentication mechanisms.

Exam trap

The trap here is that candidates often confuse AWS WAF's geo-match rules with CloudFront's built-in geographic restrictions, but the question asks for a CloudFront feature, and the native geo-blocking feature is the correct, simpler answer without requiring an additional service.

How to eliminate wrong answers

Option B is wrong because Origin Access Identity (OAI) is used to restrict access to an S3 bucket origin, not to an ALB origin, and it controls access based on identity rather than geography. Option C is wrong because Signed URLs provide time-limited access to individual files for specific users, but they do not restrict access based on geographic location; they are used for authorization, not geo-blocking. Option D is wrong because while AWS WAF can be used with CloudFront to create geo-match conditions, it is an additional service that incurs extra cost and complexity; CloudFront's built-in geographic restrictions are the native, simpler solution for this requirement.

Practice this question →

34

MCQhard

Refer to the exhibit. A SysOps administrator has attached the bucket policy shown to an S3 bucket. Users from the IP range 192.0.2.0/24 report that they can access objects, but users from other IP ranges also report they can access objects. What is the most likely reason?

A.The bucket is not configured to use the bucket policy.

B.The bucket policy is malformed and is not being applied.

C.The Condition element in the Allow statement is incorrectly formatted.

D.The bucket ACL allows public read access, overriding the bucket policy Deny.

AnswerD

Bucket ACLs are evaluated before bucket policies, and if an ACL grants access, it can override a Deny in the policy.

Why this answer

The bucket policy shown only allows access from the 192.0.2.0/24 IP range. However, if the bucket also has a bucket ACL that grants public read access to everyone, users from other IP ranges can read objects via the ACL. Bucket policies and ACLs are evaluated independently; an Allow in the ACL can grant access even if the policy does not explicitly deny it.

Since there is no explicit Deny in the bucket policy against other IPs, the ACL's public read grant allows access from all IP ranges, overriding the intent of the policy's Allow restriction.

Practice this question →

35

MCQeasy

A security team applied Network ACL rules to a subnet to allow inbound TCP traffic on port 443 (HTTPS). Users connecting from the internet can initiate connections, but they never receive responses. The NACL is applied to the subnet containing the web servers. What is missing?

A.Add an outbound NACL rule allowing TCP on destination ports 1024–65535 to permit response traffic to clients' ephemeral ports

B.Enable stateful packet inspection on the NACL by toggling the 'track connections' setting in the VPC console

C.Add a security group outbound rule allowing all traffic because NACL rules only apply to inbound traffic

D.Change port 443 to allow both TCP and UDP protocols in the inbound NACL rule

AnswerA

Ephemeral ports are the temporary high-numbered ports clients open for receiving responses. Because NACLs are stateless, return traffic must be explicitly allowed by an outbound rule. The rule 'Allow TCP outbound to 0.0.0.0/0 on ports 1024–65535' covers all client ephemeral port ranges and allows the web server's responses to flow back to the client.

Why this answer

Network ACLs are stateless, meaning they evaluate each packet independently without tracking connection state. While the inbound rule allows HTTPS traffic (TCP 443) to reach the web servers, the outbound response traffic from the servers to the clients' ephemeral ports (typically 1024–65535) is blocked by the default deny-all outbound rule. Adding an outbound NACL rule allowing TCP traffic on destination ports 1024–65535 permits the response traffic to flow back to the clients, resolving the issue.

Exam trap

The trap here is that candidates often confuse stateless NACLs with stateful security groups, assuming that allowing inbound traffic automatically permits outbound responses, when in fact NACLs require explicit outbound rules for return traffic.

How to eliminate wrong answers

Option B is wrong because NACLs are inherently stateless and do not support a 'track connections' setting; stateful packet inspection is a feature of security groups, not NACLs. Option C is wrong because NACL rules apply to both inbound and outbound traffic; adding a security group outbound rule would not affect NACL behavior, and the statement that NACL rules only apply to inbound traffic is factually incorrect. Option D is wrong because HTTPS uses TCP only (port 443), and adding UDP would not fix the missing outbound response rule; the issue is statelessness, not protocol mismatch.

Practice this question →

36

MCQeasy

A company hosts a web application on Amazon EC2 instances in two AWS regions: us-east-1 and eu-west-1. The application is behind an Application Load Balancer (ALB) in each region. The SysOps administrator wants to direct users to the region that provides the lowest latency, automatically routing traffic away from a region if it becomes unhealthy. Which Amazon Route 53 routing policy should be used?

A.Geolocation routing

B.Latency routing

C.Weighted routing

D.Failover routing

AnswerB

Latency routing uses measurements of latency between AWS regions and the user to direct traffic to the region with the lowest latency. When health checks are attached to the ALBs, latency routing automatically avoids unhealthy endpoints by excluding them from responses.

Why this answer

Latency routing (B) is correct because it directs users to the region with the lowest network latency based on real-time measurements between the user and the AWS endpoints. When a region becomes unhealthy, Route 53 automatically stops routing traffic to that region's ALB, ensuring failover to the next lowest-latency healthy region. This meets the requirement of both low-latency and automatic health-based rerouting.

Exam trap

The trap here is that candidates often confuse Geolocation routing with Latency routing, assuming geographic proximity equals low latency, but Geolocation routing does not measure actual network performance and lacks automatic health-based rerouting without additional failover records.

How to eliminate wrong answers

Option A (Geolocation routing) is wrong because it routes traffic based on the user's geographic location (e.g., country or continent), not on actual network latency, and it does not automatically reroute traffic away from an unhealthy region unless a failover record is explicitly configured. Option C (Weighted routing) is wrong because it distributes traffic based on assigned weights to multiple records, not on latency or health status; it does not automatically shift traffic away from an unhealthy region. Option D (Failover routing) is wrong because it uses an active-passive model with a primary and secondary record, but it does not consider latency; it only fails over to the secondary when the primary is unhealthy, which does not satisfy the requirement to direct users to the lowest-latency region.

Practice this question →

37

MCQeasy

A company has an on-premises data center connected to an AWS VPC via an AWS Direct Connect connection. The company's SysOps administrator wants to ensure that traffic from the VPC destined for the on-premises network uses the Direct Connect connection instead of the internet. Which configuration should be used?

A.Add a route in the VPC route table pointing to the on-premises network via a virtual private gateway (VGW)

B.Add a route in the VPC route table pointing to the on-premises network via a NAT gateway

C.Add a route in the VPC route table pointing to the on-premises network via an internet gateway

D.Add a route in the VPC route table pointing to the on-premises network via a VPC peering connection

AnswerA

The VGW is attached to the VPC and is the entry/exit point for Direct Connect. By adding a route with the on-premises destination and the VGW as the target, traffic is forced through the Direct Connect connection.

Why this answer

A virtual private gateway (VGW) is the AWS-side endpoint for an AWS Direct Connect connection when using a private virtual interface. By adding a route in the VPC route table that points the on-premises network CIDR to the VGW, all traffic destined for the on-premises network is forced over the Direct Connect link, bypassing the internet. This ensures private, low-latency, and consistent connectivity as required.

Exam trap

The trap here is that candidates often confuse the VGW with a NAT gateway or internet gateway, mistakenly thinking any gateway can route to on-premises, when only the VGW is designed for private connectivity via Direct Connect or VPN.

How to eliminate wrong answers

Option B is wrong because a NAT gateway is used to enable outbound internet traffic from private subnets, not to route traffic to an on-premises network over Direct Connect; it would send traffic to the internet, not the on-premises network. Option C is wrong because an internet gateway is designed for internet-bound traffic; routing on-premises traffic via an IGW would send it over the public internet, defeating the purpose of using Direct Connect. Option D is wrong because a VPC peering connection allows routing between two VPCs, not between a VPC and an on-premises network; it cannot be used to reach on-premises resources.

Practice this question →

38

MCQmedium

A company has two VPCs in the same AWS account and Region: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). The SysOps administrator needs to establish connectivity between these VPCs so that resources in VPC-A can reach resources in VPC-B using private IP addresses. The solution must be highly available and not involve a third-party appliance. Which solution should the administrator implement?

A.Create an AWS Transit Gateway and attach both VPCs to it. Configure route tables to allow communication.

B.Create a VPC Peering connection between VPC-A and VPC-B. Update the route tables in each VPC to add routes to the other VPC's CIDR.

C.Attach an internet gateway to each VPC and use Amazon Route 53 to resolve private DNS names over the internet.

D.Set up a site-to-site VPN connection between the two VPCs using AWS Virtual Private Gateway.

AnswerB

VPC Peering is a one-to-one networking connection between two VPCs that enables direct traffic using private IPv4 or IPv6 addresses. Because the peering connection uses AWS's existing global network, traffic never traverses the public internet, and there are no additional hourly costs for the peering itself, aside from data transfer. After the peering request is accepted, you must add explicit routes in each VPC's route table pointing to the other VPC's CIDR block, and update the security group and network ACL rules to allow the traffic. For a simple two-VPC scenario in the same account and region, this is the most straightforward and cost-effective solution.

Why this answer

VPC Peering provides direct, private IP connectivity between two VPCs using the AWS global network, with no bandwidth bottleneck or single point of failure. By creating a peering connection and adding routes to the other VPC's CIDR in each VPC's route table, resources can communicate privately and the solution is highly available as the peering connection itself is redundant within AWS's infrastructure. No third-party appliance is required, and the setup is fully managed by AWS.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing Transit Gateway (Option A) for high availability, forgetting that VPC Peering is inherently highly available within a region and is the simplest, most cost-effective option for connecting just two VPCs.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway, while capable of connecting multiple VPCs, introduces an additional cost and complexity that is unnecessary for a simple two-VPC scenario, and it is not the simplest highly available solution without a third-party appliance. Option C is wrong because attaching internet gateways and using Route 53 to resolve private DNS names over the internet would expose traffic to the public internet, violating the requirement to use private IP addresses and introducing security risks and potential availability issues. Option D is wrong because a site-to-site VPN connection requires a Virtual Private Gateway and a Customer Gateway, which adds complexity and potential single points of failure, and it is not the most straightforward highly available solution for VPC-to-VPC connectivity within the same region and account.

Practice this question →

39

MCQhard

A SysOps administrator notices that traffic from an Application Load Balancer to EC2 instances is failing intermittently. Security groups for the instances allow traffic from the ALB security group on port 80. The ALB target group health checks are failing. What is the most likely cause?

A.The network ACL for the instance's subnet is blocking inbound traffic from the ALB's subnet.

B.The instance security group does not allow outbound traffic to the ALB.

C.The ALB security group does not allow outbound traffic to the instances.

D.The ALB is in a public subnet without an internet gateway.

AnswerA

Network ACLs are stateless; if they deny inbound health check traffic from the ALB subnet, health checks will fail.

Why this answer

Network ACLs are stateless, so the subnet's NACL must explicitly allow inbound traffic from the ALB's subnet CIDR. If it does not, health check traffic from the ALB will be blocked. Option B is incorrect because the instance's security group allows inbound traffic from the ALB security group, and security groups are stateful, so return traffic is allowed automatically.

Option C is incorrect because the ALB security group does not need an outbound rule; security groups are stateful, and the ALB initiates connections to the instances. Option D is incorrect because the ALB can communicate within the VPC regardless of whether it is in a public subnet; an internet gateway is only needed for internet traffic, not for internal ALB-to-instance traffic.

Practice this question →

40

Drag & Dropmedium

Drag and drop the steps to enable AWS CloudTrail logging for a specific S3 bucket into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First create a log bucket with proper policy, then create the trail and configure it to log events for the target bucket.

Practice this question →

41

MCQmedium

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB) in the us-west-2 Region. Users are distributed globally and experience high latency. The SysOps administrator wants to improve latency and offload SSL termination to the edge. Which AWS service should be used with the ALB as the origin?

A.Amazon CloudFront

B.AWS Global Accelerator

C.AWS WAF (Web Application Firewall)

D.Amazon Route 53 with Latency Based Routing

AnswerA

Amazon CloudFront is a content delivery network that caches both static and dynamic content at edge locations geographically closer to users, reducing latency and offloading requests from the origin EC2 instances. It also terminates SSL/TLS at the edge, so decrypted traffic is forwarded over the AWS network to the origin, reducing the TLS handshake and encryption workload on the application servers. Additionally, CloudFront supports origin shielding, connection keep-alives, and multiple SSL/TLS protocols to further optimize delivery and reduce origin load.

Why this answer

Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations worldwide, reducing latency for global users. It can offload SSL termination at the edge by accepting HTTPS requests from clients and forwarding them to the ALB over HTTP or HTTPS, thereby reducing the load on the origin. This directly addresses the requirements of improving latency and offloading SSL termination.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator with CloudFront, thinking both provide caching, but Global Accelerator only optimizes network path routing and does not cache content or terminate SSL at the edge.

How to eliminate wrong answers

Option B (AWS Global Accelerator) is wrong because it improves latency by routing traffic over the AWS global network using Anycast IPs, but it does not cache content or offload SSL termination at the edge; SSL termination still occurs at the ALB or EC2 instances. Option C (AWS WAF) is wrong because it is a web application firewall that filters malicious traffic, not a service for reducing latency or offloading SSL termination. Option D (Amazon Route 53 with Latency Based Routing) is wrong because it only directs DNS queries to the lowest-latency endpoint, but it does not cache content or terminate SSL at the edge; the actual traffic still goes directly to the ALB, and SSL termination remains at the origin.

Practice this question →

42

MCQeasy

A company is using an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The SysOps administrator receives reports that some users are experiencing intermittent HTTP 503 errors. What is the most likely cause?

A.The security group attached to the ALB does not allow inbound traffic on port 443.

B.The health checks are failing for the target group, causing the ALB to stop sending traffic to all instances.

C.The EC2 instances do not have the correct IAM role to register with the ALB.

D.The ALB idle timeout is set too low.

AnswerB

If all targets are unhealthy, ALB returns 503.

Why this answer

HTTP 503 errors from an Application Load Balancer typically indicate that the target group has no healthy registered targets. When health checks fail for all instances in the target group, the ALB cannot route traffic to any backend, resulting in a 503 response. This is the most common cause of intermittent 503 errors in ALB architectures.

Exam trap

The trap here is that candidates often confuse HTTP 503 errors with connectivity or timeout issues, but the ALB specifically returns 503 only when no healthy targets exist, not for security group or timeout misconfigurations.

How to eliminate wrong answers

Option A is wrong because if the ALB security group did not allow inbound traffic on port 443, users would receive connection timeouts or 504 errors, not HTTP 503 errors. Option C is wrong because EC2 instances do not require an IAM role to register with an ALB; registration is handled by the Auto Scaling group or manual attachment, and IAM roles are used for API calls, not for target registration. Option D is wrong because a low idle timeout would cause the ALB to close idle connections, resulting in 504 Gateway Timeout errors, not 503 Service Unavailable errors.

Practice this question →

43

MCQmedium

A company has an Amazon CloudFront distribution that delivers static content from an Amazon S3 bucket. The SysOps administrator needs to ensure that the content can only be accessed through CloudFront and not directly from the S3 bucket URL. The solution should use AWS managed services with minimal configuration. Which solution should the administrator implement?

A.Configure the S3 bucket policy to deny all access except from the CloudFront distribution's origin access identity (OAI).

B.Make the S3 bucket private and use pre-signed URLs for CloudFront.

C.Use AWS WAF on CloudFront to block direct access to S3 by checking the Referer header.

D.Create a VPC endpoint for S3 and restrict access to the bucket from the CloudFront IP addresses.

AnswerA

An Origin Access Identity (OAI) is a special CloudFront identity that can be assigned to a distribution, and the S3 bucket policy can explicitly grant read permission to that OAI's principal while using an explicit deny for all other principals. Since CloudFront signs requests as the OAI, only the distribution can fetch objects from the bucket; direct access to the S3 website or REST endpoint is rejected. This is the recommended AWS pattern because it relies on IAM evaluation of the caller identity rather than a client-controlled header or an IP-based allow list.

Why this answer

Configuring the S3 bucket policy to deny all access except from the CloudFront distribution's origin access identity (OAI) ensures that only CloudFront can retrieve objects from the S3 bucket. The OAI is a special CloudFront user that authenticates requests to S3, and the bucket policy explicitly grants GetObject access only to that principal, blocking any direct S3 URL access. This uses AWS managed services (CloudFront and S3) with minimal configuration—no custom code or additional infrastructure.

Exam trap

The trap here is that candidates often choose Option C (AWS WAF with Referer header) because it seems like a simple web-application-layer control, but they overlook that the Referer header is easily spoofed and does not provide cryptographic authentication, unlike the OAI-based approach which uses AWS Signature Version 4 to verify the request origin.

How to eliminate wrong answers

Option B is wrong because making the S3 bucket private and using pre-signed URLs for CloudFront adds unnecessary complexity; CloudFront does not natively generate pre-signed URLs for origin requests, and this would require custom logic to sign each request, defeating the 'minimal configuration' requirement. Option C is wrong because using AWS WAF to block direct access by checking the Referer header is unreliable—the Referer header can be spoofed or omitted by clients, and it does not prevent direct S3 URL access from scripts or tools that don't send a Referer. Option D is wrong because creating a VPC endpoint for S3 and restricting access to CloudFront IP addresses is not feasible; CloudFront uses a large, dynamic set of global IP addresses that are not static, and maintaining an allow list of those IPs would require constant updates and is not a 'minimal configuration' solution.

Practice this question →

44

MCQmedium

A company runs an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB terminates SSL/TLS and forwards traffic to the instances over HTTP. The SysOps administrator needs to capture the original client IP address in the instance logs. How should the administrator configure this?

A.Enable stickiness on the ALB target group.

B.Enable the X-Forwarded-For header on the ALB.

C.Configure the ALB to use Proxy Protocol v2.

D.Enable access logs on the ALB and store them in Amazon S3.

AnswerB

The ALB automatically adds the X-Forwarded-For header to each HTTP/HTTPS request as it passes through, containing the original client IP address in a comma-separated list. Since the ALB terminates the client's TLS connection and opens a new connection to the target, the EC2 instance must read this header to record the client IP in its logs. By default, the ALB overwrites any existing X-Forwarded-For header to prevent client spoofing, and you should configure your web server or application to log the first IP in the header, which is the true client IP.

Why this answer

When an Application Load Balancer terminates SSL/TLS and forwards traffic to EC2 instances over HTTP, the original client IP address is preserved by the ALB in the X-Forwarded-For header. By enabling this header on the ALB, the SysOps administrator ensures that the web server or application can log the true client IP, which is essential for analytics, security, and troubleshooting.

Exam trap

The trap here is that candidates confuse Proxy Protocol v2 (used for NLB TCP/UDP listeners) with the X-Forwarded-For header (used for ALB HTTP/HTTPS listeners), leading them to select option C even though it is not applicable to ALB's HTTP-based forwarding.

How to eliminate wrong answers

Option A is wrong because enabling stickiness (session affinity) on the ALB target group only ensures that requests from the same client are routed to the same target instance; it does not capture or forward the original client IP address. Option C is wrong because Proxy Protocol v2 is used with Network Load Balancers (NLB) or TCP listeners, not with Application Load Balancers (ALB) which use HTTP/HTTPS listeners and rely on the X-Forwarded-For header for client IP preservation. Option D is wrong because enabling ALB access logs and storing them in Amazon S3 captures request details including client IP, but it does not inject the original client IP into the instance logs; the instance logs still see the ALB's private IP unless the X-Forwarded-For header is used.

Practice this question →

45

MCQhard

A company has a VPC with public and private subnets. The public subnet has a NAT Gateway. The private subnet has an EC2 instance that needs to download patches from the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instance cannot reach the internet. What is the most likely cause?

A.The network ACL for the private subnet blocks outbound HTTP traffic.

B.The security group of the EC2 instance blocks outbound traffic.

C.The NAT Gateway is deployed in a private subnet.

D.The NAT Gateway does not have an Elastic IP address.

AnswerC

Correct. A NAT Gateway must be deployed in a public subnet with a route to an Internet Gateway. If it is in a private subnet, it cannot access the internet, breaking the connectivity for instances using it.

Why this answer

A NAT Gateway must be deployed in a public subnet with a route to an Internet Gateway. If the NAT Gateway is in a private subnet, it cannot access the internet, and thus the instances in the private subnet cannot reach the internet via it. Option A is incorrect because network ACLs by default allow all outbound traffic; even if they block HTTP, the instance might still reach other services, but the core issue is the NAT Gateway placement.

Option B is incorrect because security groups by default allow all outbound traffic; unless explicitly modified, outbound is not blocked. Option D is incorrect because while a NAT Gateway does require an Elastic IP to communicate with the internet, the more fundamental and likely cause is that the NAT Gateway is in a private subnet, which renders it non-functional regardless of Elastic IP.

Practice this question →

46

MCQhard

A company has a VPC with public and private subnets. A NAT Gateway is deployed in the public subnet to allow instances in the private subnet to access the internet. However, private instances cannot reach an external service at 203.0.113.50:443. What should be checked first?

A.The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT Gateway.

B.The NAT Gateway has an Elastic IP assigned.

C.The security group for the NAT Gateway allows inbound traffic from the private subnet.

D.The internet gateway is attached to the VPC.

AnswerA

Without this route, traffic from private instances cannot reach the NAT Gateway, so they cannot access the internet.

Why this answer

The first thing to check when private instances cannot reach an external service is the route table for the private subnet. The private subnet must have a route 0.0.0.0/0 pointing to the NAT Gateway to route internet-bound traffic through it. Option B is incorrect because the NAT Gateway must have an Elastic IP to be reachable from the internet, but the issue described is outbound access from private instances; the NAT Gateway's Elastic IP is necessary but not the first check.

Option C is incorrect because security groups for NAT Gateways are not used; NAT Gateways do not have security groups; instead, network ACLs on the subnets control traffic. Option D is incorrect because the internet gateway must be attached to the VPC for the NAT Gateway to work, but if private instances cannot reach the external service, the routing from the private subnet to the NAT Gateway is the primary suspect.

Practice this question →

47

MCQeasy

A company has an application running on EC2 instances in a VPC. The application needs to access an S3 bucket in the same AWS region. Which configuration provides the MOST secure and cost-effective access?

A.Make the S3 bucket publicly accessible and use the public endpoint from the EC2 instances.

B.Set up a NAT Gateway in a public subnet and route traffic from the EC2 instances through it to the S3 endpoint.

C.Create a VPC Gateway Endpoint for S3 and update the route tables for the private subnets.

D.Create an Internet Gateway and route traffic from the EC2 instances through it to a public S3 endpoint.

AnswerC

Gateway Endpoint provides private, secure, and free connectivity to S3 within the same region.

Why this answer

A VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 directly over the AWS network without traversing the internet, eliminating the need for a NAT Gateway or Internet Gateway. This provides the most secure and cost-effective access by keeping traffic within the AWS backbone and avoiding data transfer costs associated with NAT Gateways or public endpoints.

Exam trap

The trap here is that candidates often confuse VPC Gateway Endpoints with VPC Interface Endpoints (powered by AWS PrivateLink), but for S3, a Gateway Endpoint is the correct and most cost-effective choice because it does not require an Elastic Network Interface or incur hourly charges, unlike an Interface Endpoint.

How to eliminate wrong answers

Option A is wrong because making the S3 bucket publicly accessible exposes it to the entire internet, violating security best practices and potentially leading to unauthorized access or data breaches. Option B is wrong because a NAT Gateway incurs hourly charges and data processing costs, and it routes traffic through the internet unnecessarily, making it less cost-effective and less secure than a VPC Gateway Endpoint. Option D is wrong because an Internet Gateway is designed for public internet access, and routing EC2 traffic through it to a public S3 endpoint exposes the traffic to the internet, increasing latency and security risks while adding unnecessary complexity and cost.

Practice this question →

48

Multi-Selecteasy

Which TWO security measures should be implemented to protect a VPC from DDoS attacks? (Choose two.)

Select 2 answers

A.Use AWS WAF with rate-based rules

B.Enable AWS Shield Advanced

C.Apply network ACLs with deny rules

D.Use restrictive security groups

E.Enable VPC Flow Logs

AnswersA, B

AWS WAF rate-based rules are specifically engineered to mitigate application-layer DDoS attacks by tracking the number of requests from a single client IP within a set time window. When the request count exceeds the configured threshold, AWS WAF blocks subsequent traffic from that IP for the rule's duration, effectively limiting the volume of requests that can reach your origin. This provides an automated, scalable defense that can be attached to Amazon CloudFront, ALB, or API Gateway, and it allows you to fine-tune thresholds based on your normal traffic baseline.

Why this answer

AWS Shield Advanced provides DDoS protection. Using a web application firewall (WAF) at the edge helps filter malicious traffic. Security groups and NACLs are not effective against DDoS at scale.

Practice this question →

49

MCQeasy

A company wants to establish a dedicated, low-latency, private connection between its on-premises data center and an AWS VPC. The company does not want to use the public internet. Which AWS service should be used to meet this requirement?

A.AWS Direct Connect

B.AWS Virtual Private Gateway

C.AWS Transit Gateway

D.VPC Peering

AnswerA

Correct. AWS Direct Connect provides a dedicated private connection between on-premises and AWS, avoiding the public internet.

Why this answer

AWS Direct Connect is the correct service because it provides a dedicated, private, low-latency network connection from an on-premises data center to AWS, bypassing the public internet entirely. It uses industry-standard 802.1Q VLANs to create a private virtual interface (VIF) that connects directly to a VPC, ensuring consistent network performance and reduced latency.

Exam trap

The trap here is that candidates often confuse AWS Virtual Private Gateway (a required attachment for Direct Connect) with the Direct Connect service itself, or they assume VPC Peering can extend to on-premises networks, but VPC Peering is strictly limited to inter-VPC connectivity within AWS.

How to eliminate wrong answers

Option B (AWS Virtual Private Gateway) is wrong because it is a logical component that attaches to a VPC to enable VPN or Direct Connect connections, but it is not a service that itself provides a dedicated private connection; it requires Direct Connect or a VPN to function. Option C (AWS Transit Gateway) is wrong because it is a network transit hub used to interconnect multiple VPCs and on-premises networks, but it does not provide the dedicated physical connection itself; it relies on Direct Connect or VPN for the on-premises link. Option D (VPC Peering) is wrong because it only connects two VPCs within AWS using the AWS global network, and it cannot be used to connect an on-premises data center to a VPC.

Practice this question →

50

MCQhard

A company uses AWS Direct Connect to connect its on-premises network to AWS. The SysOps team notices that traffic from the on-premises network to a VPC is not using the Direct Connect connection but instead is going over the internet. The VPC has a virtual private gateway attached and the on-premises router is advertising a specific route. What is the most likely cause?

A.The on-premises network does not have a route to the VPC CIDR.

B.The VPC route table has a more specific route (e.g., 0.0.0.0/0) pointing to an Internet Gateway.

C.The BGP session between the on-premises router and the Direct Connect router is down.

D.The virtual private gateway is not attached to the VPC.

AnswerC

If the BGP session is down, the on-premises router cannot exchange routes with the Direct Connect router, so it loses the Direct Connect path to the VPC and falls back to internet routing. This is the most likely cause.

Why this answer

The BGP session between the on-premises router and the Direct Connect router is down. When BGP is down, the on-premises router cannot exchange routes with the AWS side over Direct Connect. Even though the on-premises router may be advertising a specific route, without an active BGP session, that route is not received by the Direct Connect router, and the virtual private gateway does not propagate it into the VPC.

As a result, traffic from the on-premises network to the VPC falls back to using the internet route instead of Direct Connect. Option B is incorrect because the VPC route table controls outbound traffic from the VPC, not inbound traffic from on-premises; a default route to an Internet Gateway would cause asymmetric routing for return traffic but would not prevent inbound traffic from using Direct Connect if the BGP session is active.

Exam trap

The trap is that candidates often suspect VPC route misconfigurations or virtual private gateway attachment issues, but the core problem is a failed BGP session on the Direct Connect link, which stops route exchange between on-premises and AWS.

How to eliminate wrong answers

Option A is wrong because if the on-premises network lacked a route to the VPC CIDR, traffic would not reach the VPC at all, but the scenario states traffic is going over the internet, indicating a route exists but is misdirected. Option C is wrong because if the BGP session were down, the on-premises router would not advertise any routes, and the VPC would have no learned route to the on-premises network, causing traffic to fail or use the internet gateway as a default; however, the question states the on-premises router is advertising a specific route, implying BGP is up. Option D is wrong because if the virtual private gateway were not attached to the VPC, the VPC would have no connectivity to Direct Connect, and traffic would either fail or use the internet gateway, but the scenario specifically mentions a virtual private gateway is attached, making this option incorrect.

Practice this question →

51

MCQeasy

A company is using Amazon CloudFront to distribute content globally. The company wants to restrict access to content so that only users from specific countries can access it. Which CloudFront feature should be used?

A.AWS WAF

B.Signed URLs

C.Geo restriction

D.Origin Access Identity (OAI)

AnswerC

Geo restriction (geo-blocking) allows you to allow or deny access to content based on the viewer's country.

Why this answer

CloudFront's geo restriction feature (also known as geo-blocking) allows you to allow or block access to your content based on the geographic location of the viewer's IP address. This is the correct choice because the requirement is specifically to restrict access by country, which is exactly what geo restriction does by using a country-level allowlist or blocklist.

Exam trap

The trap here is that candidates often confuse geo restriction with AWS WAF's geo-match conditions, but the question explicitly asks for a CloudFront feature, and geo restriction is the native, simpler option that does not require WAF integration.

How to eliminate wrong answers

Option A is wrong because AWS WAF is a web application firewall that filters traffic based on rules like SQL injection or IP addresses, but it does not natively provide country-level access control without additional configuration (though it can be integrated with CloudFront for geo-matching via IP sets, the question asks for the CloudFront feature itself). Option B is wrong because Signed URLs provide temporary access to individual files by requiring a cryptographic signature, but they do not restrict access based on the viewer's geographic location. Option D is wrong because Origin Access Identity (OAI) is used to restrict access to an S3 origin so that only CloudFront can fetch content, but it does not control which end users can access the content based on their country.

Practice this question →

52

Multi-Selectmedium

A company is designing a VPC with public and private subnets. The private subnets need internet access for patching, but must not be directly reachable from the internet. Which TWO components should be used together?

Select 2 answers

A.VPC Peering connection

B.Private subnet route table with a route to the Internet Gateway

C.Internet Gateway attached to the VPC

D.Private subnet route table with a route to the NAT Gateway

E.NAT Gateway in a public subnet

AnswersD, E

This route directs traffic from private subnets to the NAT Gateway.

Why this answer

The correct answers are D and E. A NAT Gateway placed in a public subnet (E) provides outbound internet access for instances in private subnets. The private subnet's route table must have a route pointing to the NAT Gateway (D) for internet-bound traffic.

VPC Peering (A) connects VPCs but does not provide internet access. An Internet Gateway (C) attached to the VPC enables internet access for public subnets, but private subnets should not have a direct route to it. Option B (private route to IGW) would make the subnet public, violating the requirement.

Therefore, D and E together provide the desired outbound-only internet access.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Networking and Content Delivery questions.

Start 20-question session