ANS-C01 Question Bank · Latest 50 Questions Free Preview (Page 1/5)
Questions 1–10 of the latest 50 ANS-C01 questions (5 pages total), with answers and explanations, no login required. Practice all 690 questions online.
Question 1 · No. 641 · Single choice
A company has several AWS Site-to-Site VPN connections between an on-premises customer gateway and a transit gateway. The company's application uses IPv4 to communicate through the VPN connections. The company has updated the VPC to be dual stack and wants to transition to using IPv6-only for new workloads. When the company tries to communicate through the existing VPN connections, IPv6 traffic fails. Which solution will provide IPv6 support with the LEAST operational overhead?
- A. Create a new Site-to-Site VPN connection that supports IPv6.
- B. Create a new Site-to-Site VPN connection to a self-managed Amazon EC2 instance that runs open source software.
- C. Update the existing Site-to-Site VPN connections to support IPv6.
- D. Update the on-premises customer gateway's public IP address from IPv4 to IPv6.
Answer: A
Explanation: The existing AWS Site-to-Site VPN connections do not support IPv6, so updating them directly is not an option. Creating a new Site-to-Site VPN connection that supports IPv6 (option A) involves the least operational overhead compared to options like deploying and managing a self-managed EC2 instance (option B), which adds complexity, or reconfiguring the customer gateway's IP address (option D), which could disrupt existing IPv4 traffic. Option C is invalid because AWS does not allow updating existing VPN connections to add IPv6 support.
Question 2 · No. 642 · Single choice
A company runs a workload in a single VPC on AWS. The company’s architecture contains several interface VPC endpoints for AWS services, including Amazon CloudWatch Logs and AWS Key Management Service (AWS KMS). The endpoints are configured to use a shared security group. The security group is not used for any other workloads or resources. After a security review of the environment, the company determined that the shared security group is more permissive than necessary. The company wants to make the rules associated with the security group more restrictive. The changes to the security group rules must not prevent the resources in the VPC from using AWS services through interface VPC endpoints. The changes must prevent unnecessary access. The security group currently uses the following rules: • Inbound - Rule 1 Protocol: TCP - Port: 443 - Source: 0.0.0.0/0 - • Inbound - Rule 2 Protocol: TCP - Port: 443 - Source: VPC CIDR - • Outbound - Rule 1 Protocol: All - Port: All - Destination: 0.0.0.0/0 - Which rule or rules should the company remove to meet with these requirements?
- A. Outbound - Rule 2
- B. Inbound - Rule 1 and Outbound - Rule 1
- C. Inbound - Rule 2 and Outbound - Rule 1
- D. Outbound - Rule 1
Answer: B
Explanation: The company wants to make the security group rules more restrictive while ensuring that resources in the VPC can still use AWS services through interface VPC endpoints. Inbound Rule 1 allows traffic from any source (0.0.0.0/0) on port 443, which is overly permissive. Interface VPC endpoints only require traffic from within the VPC itself (VPC CIDR), so this rule can be removed. Outbound Rule 1 allows all traffic to any destination (0.0.0.0/0), which is unnecessary for interface VPC endpoints since they only communicate with AWS services. Therefore, removing Inbound Rule 1 and Outbound Rule 1 ensures that the security group is more restrictive while maintaining necessary access.
Question 3 · No. 643 · Single choice
A company deployed an application in two AWS Regions in one AWS account. The company has one VPC in each Region. The VPCs use non-overlapping private CIDR ranges. The company needs to connect both VPCs to a single on-premises data center to test the application. The application requires up to 800 Mbps of throughput. A network engineer needs to establish connectivity between the VPCs and the on-premises data center. Which solution will meet this requirement with the LEAST operational overhead?
- A. Order a 2 Gbps Direct Connect connection for the data center. Configure a virtual private gateway in each VPC. Create a private VIF for each virtual private gateway, and associate the virtual private gateways with the Direct Connect connection. Configure static routes in the VPC route tables and in the data center router.
- B. Order a 2 Gbps Direct Connect connection for the data center. Configure a virtual private gateway in each VPC. Create a private VIF for each virtual private gateway, and associate the virtual private gateways with the Direct Connect connection. Configure Open Shortest Path First (OSPF) routing between the private VIF and the data center.
- C. Configure a customer gateway and a virtual private gateway in each VPConfigure an AWS Site-to-Site VPN connection between the data center and each VPConfigure static routes in each VPC route table to point to the subnets in the data center.
- D. Configure a customer gateway and a virtual private gateway in each VPC. Configure an AWS Site-to-Site VPN connection between the data center and each VPC. Configure BGP routing between the VPCs and the data center.
Answer: D
Explanation: The requirement specifies connecting two VPCs to an on-premises data center with minimal operational overhead. Using AWS Site-to-Site VPN with BGP routing meets this need efficiently. BGP is a dynamic routing protocol that reduces manual configuration and automatically adjusts routes, providing the least operational overhead. Additionally, AWS Site-to-Site VPN supports up to 1.25 Gbps, which comfortably meets the 800 Mbps throughput requirement.
Question 4 · No. 644 · Single choice
A company has multiple VPCs with subnets that use IPv4. Traffic from the VPCs to the internet uses a NAT gateway. The company wants to transition to IPv6. A network engineer creates multiple IPv6-only subnets in an existing testing VPC. The network engineer deploys a new Amazon EC2 instance that has an IPv6 address into one of the subnets. During testing, the network engineer discovers that the new EC2 instance is not able to communicate with an IPv4-only service through the internet. The network engineer needs to enable the IPv6 EC2 instance to communicate with the IPv4-only service. Which solution will meet this requirement?
- A. Enable DNS64 for the IPv6-only subnets. Update the route tables for the IPv6-only subnets to send traffic through the NAT gateway.
- B. Enable NAT64 for the testing VPC. Reconfigure the existing NAT gateway to support IPv6.
- C. Enable DNS64 for the new EC2 instance. Create a new egress-only internet gateway that supports IPv6.
- D. Enable NAT64 for each route table. Create a new NAT gateway that supports both IPv4 and IPv6.
Answer: A
Question 5 · No. 645 · Multiple choice
A company is migrating its internet VPN connections to dedicated AWS Direct Connect connections. The company needs to set up the Direct Connect connections so that all network communications are encrypted in transit. Which combination of steps will meet this requirement? (Choose three.)
- A. Create new Direct Connect connections while requesting MACsec ports.
- B. Create a MACsec Connectivity Association Key Name (CKN) and Connectivity Association Key (CAK) pair. Associate the pair with each new connection.
- C. Update the on-premises routers to use MACsec and the shared Connectivity Association Key Name (CKN) and Connectivity Association Key (CAK) pair.
- D. Create a shared key for an IPsec connection.
- E. Configure a new Direct Connect gateway. Associate the shared key with the new Direct Connect gateway.
- F. Set up IPsec on the on-premises router. Associate the shared key with the IPsec configuration.
Answer: A, B, C
Explanation: To ensure all network communications are encrypted in transit over AWS Direct Connect, the solution must combine MACsec (Layer 2 encryption) with proper configuration. Option A involves requesting MACsec-enabled ports for new Direct Connect connections. Option B describes creating a MACsec Connectivity Association Key Name (CKN) and Connectivity Association Key (CAK) pair to associate with the connections. Option C ensures that on-premises routers are updated to use MACsec and the shared CKN/CAK pair. Together, these steps enable MACsec encryption between the on-premises infrastructure and AWS. Options D, E, and F refer to IPsec, which is not natively supported directly over Direct Connect and is unnecessary when MACsec is properly configured.
Question 6 · No. 646 · Single choice
A company runs workloads in multiple VPCs. The company needs to securely access a workload in one of the VPCs, named VPC-A, from an on-premises data center. A network engineer sets up an AWS Site-to-Site VPN connection to a transit gateway. The network engineer configures dynamic routing for the connection, and communication works properly. Recently, the owner of VPC-A added another CIDR range to the VPC. The VPC-A owner created workloads that use the additional CIDR range. The company's on-premises network is unable to reach the new workloads. The network engineer needs to resolve the network connectivity issue and ensure that connectivity will not be affected if additional VPC CIDR ranges are added to the VPC in the future. Which solution will meet these requirements with the MOST operational efficiency?
- A. Configure route propagation for VPC-A to the VPN attachment route table.
- B. Manually update the VPN attachment route table to include the new CIDR range.
- C. Configure an Amazon EventBridge rule to invoke an AWS Lambda function when the rule to matches an update to the VPC-A CIDR range. Configure the Lambda function to update the VPN attachment route table.
- D. Configure an Amazon CloudWatch alarm to invoke an AWS Lambda function when there is an update to the VPC-A CIDR range. Configure the Lambda function to update the VPN attachment route table. Restart the VPN tunnels.
Answer: A
Explanation: The most operationally efficient solution is to configure route propagation for VPC-A to the VPN attachment route table. Route propagation automatically updates the route table with any new CIDR ranges added to VPC-A, ensuring that connectivity is not affected when additional CIDR ranges are added in the future. This approach eliminates the need for manual intervention or complex automation scripts, making it both reliable and efficient.
Question 7 · No. 647 · Single choice
A US-based company is expanding its business to Europe. A network engineer needs to extend the company's network infrastructure by setting up a new hub and spoke architecture in the eu-west-1 Region. The network engineer uses a transit gateway peering connection to connect the new resources in eu-west-1 to an existing environment in the us-east-1 Region. The hub and spoke architecture in each AWS Region includes an inspection VPC that uses AWS Network Firewall to centralize traffic inspection for each Region. To reduce costs, the network engineer decides to inspect inter-Region traffic by using the inspection VPC in the Region that originates the traffic. The network engineer configures the transit gateway route tables accordingly for each Region. When the network engineer tests the new architecture, communication within each Region works as expected. However, the network engineer finds that inter-Region communication is not working. The network engineer must resolve the inter-Region communication issue. Which solution will meet this requirement?
- A. Configure Open Shortest Path First (OSPF) routing on the transit gateway peering connection to propagate the VPC CIDR blocks from each Region to the remote peer.
- B. Use AWS Resource Access Manager (AWS RAM) to share access between the transit gateways. Enable the Allow sharing with anyone setting.
- C. Prevent asymmetric routing in the inspection VPCs by ensuring that both requests and responses are inspected by the same inspection VPC
- D. Enable Appliance mode on both the transit gateway attachments for the inspection VPC.
Answer: D
Explanation: The issue described in the scenario is related to inter-Region communication not working due to the inspection VPC setup and routing. Enabling Appliance mode on the transit gateway attachments for the inspection VPC ensures that traffic follows a symmetrical path, which is necessary when using an inspection VPC with AWS Network Firewall. Without Appliance mode, asymmetric routing can occur because return traffic may not follow the same path as the original traffic. This would break the inspection process and cause communication issues between Regions.
Question 8 · No. 648 · Single choice
A company needs to capture and log traffic for Nitro-based Amazon EC2 instances to comply with regulations. The company's network team has prepared a solution that enables VPC traffic mirroring and sends traffic to a second set of EC2 instances in an Auto Scaling group. The network team has added a Network Load Balancer (NLB) in front of the EC2 instances the traffic will be sent to. However, the solution does not send any mirrored traffic to the EC2 instances that are behind the NLB. How should the network team configure traffic mirroring to use the NLB endpoint?
- A. Select the NLB as a source for traffic mirroring. Use a UDP listener.
- B. Select the NLB as a target for traffic mirroring. Use a TCP listener and a UDP listener.
- C. Select the NLB as a target for traffic mirroring. Use a TCP listener.
- D. Select the NLB as a target for traffic mirroring. Use a UDP listener.
Answer: D
Explanation: The correct answer is D because, in the context of VPC traffic mirroring, the Network Load Balancer (NLB) needs to be selected as a target for mirrored traffic. Additionally, traffic mirroring works with a UDP listener rather than TCP, making this the appropriate configuration choice. Other options involving TCP or incorrect configurations would not allow the proper handling of mirrored traffic.
Question 9 · No. 649 · Multiple choice
A company has five VPCs in the us-east-1 Region. The company hosts an internal web application in us-east-1. One of the company's VPCs. named VPC-A, needs to connect to an external partner's AWS environment. The partner’s environment is in the same AWS Region where the partner hosts a new version of the company's web application. The partner hosts its version of the application in a VPC named VPC-B. The company has Amazon EC2 instances in VPC-A that need to connect to the web application in VPC-B A network engineer notices that the partner's VPC-B and the company's VPC-A use the same IP space. The network engineer needs a solution to allow the EC2 instances to connect to the web application. The solution must not negatively affect the exiting environment of the company or the partner. Which combination of steps should the network engineer take meet these requirements? (Choose two.)
- A. Establish a VPC peering connection between VPC-A to VPC-B.
- B. Ensure the partner creates a VPC endpoint service that uses a Network Load Balancer in VPC-B.
- C. Deploy a VPC endpoint in VPC-A that uses a VPC endpoint service that is shared by the partner.
- D. Deploy a new routable VPC CIDR block as a secondary CIDR block to both VPC-A and VPC-B. Deploy a public NAT gateway in VPC-A.
- E. Establish an AWS Site-to-Site VPN connection between VPC-A and VPC-B.
Answer: B, C
Explanation: The problem involves connecting two VPCs (VPC-A and VPC-B) that have overlapping IP spaces. Overlapping IP spaces make direct VPC peering or routing impossible without causing IP conflicts. The best solution is to use AWS PrivateLink, which allows private connectivity between VPCs without exposing the traffic to the public internet or requiring changes to the existing IP space. Option B suggests the partner creates a VPC endpoint service using a Network Load Balancer in VPC-B, which enables VPC-B to expose its services securely. Option C involves deploying a VPC endpoint in VPC-A that connects to the VPC endpoint service shared by the partner. This combination avoids IP conflicts and ensures secure communication. Other options like VPC peering (A), secondary CIDR blocks with NAT (D), or Site-to-Site VPN (E) either fail to address the IP overlap issue or introduce unnecessary complexity.
Question 10 · No. 650 · Single choice
A company hosts an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are part of an Amazon EC2 Auto Scaling group. To comply with new security standards, the company must capture all application access data, including server response codes, request paths, latency, and client IP addresses. The company also needs to query the captured data for performance analysis. Which solution will meet these requirements?
- A. Enable VPC flow logs on the ALB subnets. Store the logs to an Amazon S3 bucket. Query the logs in the S3 bucket by using Amazon Athena.
- B. Configure Amazon VPC Traffic Mirroring on all EC2 elastic network interfaces. Deploy a third-party monitoring appliance from AWS Marketplace in a private subnet. Use Amazon Data Firehose to send all mirrored traffic to the monitoring appliance. Query the logs directly from the monitoring appliance.
- C. Configure Amazon CloudWatch detailed monitoring on the EC2 instances Include all available logs. Use Amazon Data Firehose to send all the collected logs to an Amazon S3 bucket. Query the data directly from the S3 bucket.
- D. Enable access logs on the ALB. Store the logs in an Amazon S3 bucket. Query the logs in the S3 bucket by using Amazon Athena.
Answer: D
Explanation: The question requires capturing all application access data, including server response codes, request paths, latency, and client IP addresses, while also enabling querying for performance analysis. Option D is the correct choice because enabling access logs on the ALB directly captures all HTTP/HTTPS request details sent to the load balancer, which matches the requirements perfectly. The logs are stored in an S3 bucket, and Amazon Athena can query them efficiently. Other options either capture incomplete or irrelevant data (e.g., VPC Flow Logs in A), introduce unnecessary complexity (e.g., Traffic Mirroring in B), or do not fully meet the logging and querying needs (e.g., CloudWatch detailed monitoring in C).