AWS ANS-C01 Practice Questions with Explanations

Q: A company is planning to create a service that requires encryption in transit. The traffic must not be decrypted between the client and the backend of the service. The company will implement the service by using the gRPC protocol over TCP port 443. The service will scale up to thousands of simultane

A. A Network Load Balancer with a TCP listener on port 443 is required because gRPC uses HTTP/2 over TLS, and NLB with TCP passthrough preserves the encrypted connection end-to-end without decryption, enabling mutual TLS between client and backend. The AWS Load Balancer Controller manages the NLB and routes to Pod IP addresses directly, supporting the required scaling with Kubernetes autoscalers.

Q: A company has developed an application on AWS that will track inventory levels of vending machines and initiate the restocking process automatically. The company plans to integrate this application with vending machines and deploy the vending machines in several markets around the world. The applica

D. The ALB must be in a private subnet with an internet gateway and routes configured so the Global Accelerator can reach it. The ALB's security group must restrict inbound traffic to only the accelerator's IP address ranges on the listener port, ensuring the application is accessible only through Global Accelerator and not directly from the internet.

Q: A global delivery company is modernizing its fleet management system. The company has several business units. Each business unit designs and maintains applications that are hosted in its own AWS account in separate application VPCs in the same AWS Region. Each business unit's applications are design

C. VPC endpoint services powered by AWS PrivateLink provide granular security controls through service-level permissions and do not require full mesh connectivity, enabling scalable architecture as more business units are added. Each business unit can independently create VPC endpoints to consume the central service with isolated, controlled access.

Q: A company uses a 4 Gbps AWS Direct Connect dedicated connection with a link aggregation group (LAG) bundle to connect to five VPCs that are deployed in the us- east-1 Region. Each VPC serves a different business unit and uses its own private VIF for connectivity to the on-premises environment. Users

A. CloudWatch metrics VirtualInterfaceBpsEgress and VirtualInterfaceBpsIngress are the correct metrics to identify which VIF (and thus which business unit) is consuming the most throughput during the slowness period. Upgrading to a 10 Gbps dedicated connection resolves the saturation issue while allowing identification of the offending business unit.

August 14, 2026

Free AWS ANS-C01 practice questions. 50 of them, each with the correct answer, a full explanation, and the reason every other option is wrong. These are real questions from the ANS-C01 exam, not paraphrases, and every explanation is written out rather than just marking the right letter.

They are drawn from the same bank as the full ANS-C01 pack, which has 296 questions in total.

Get the full ANS-C01 question bank (296 questions) →

ANS-C01 practice questions

Question 1

A company is planning to create a service that requires encryption in transit. The traffic must not be decrypted between the client and the backend of the service. The company will implement the service by using the gRPC protocol over TCP port 443. The service will scale up to thousands of simultaneous connections. The backend of the service will be hosted on an Amazon Elastic Kubernetes Service (Amazon EKS) duster with the Kubernetes Cluster Autoscaler and the Horizontal Pod Autoscaler configured. The company needs to use mutual TLS for two-way authentication between the client and the backend. Which solution will meet these requirements?

A. Install the AWS Load Balancer Controller for Kubernetes. Using that controller, configure a Network Load Balancer with a TCP listener on port 443 to forward traffic to the IP addresses of the backend service Pods.
B. Install the AWS Load Balancer Controller for Kubernetes. Using that controller, configure an Application Load Balancer with an HTTPS listener on port 443 to forward traffic to the IP addresses of the backend service Pods.
C. Create a target group. Add the EKS managed node group's Auto Scaling group as a target Create an Application Load Balancer with an HTTPS listener on port 443 to forward traffic to the target group.
D. Create a target group. Add the EKS managed node group's Auto Scaling group as a target. Create a Network Load Balancer with a TLS listener on port 443 to forward traffic to the target group.

Show answer and explanation ▾

Correct answer: A

A Network Load Balancer with a TCP listener on port 443 is required because gRPC uses HTTP/2 over TLS, and NLB with TCP passthrough preserves the encrypted connection end-to-end without decryption, enabling mutual TLS between client and backend. The AWS Load Balancer Controller manages the NLB and routes to Pod IP addresses directly, supporting the required scaling with Kubernetes autoscalers.

Why the other options are wrong:

B. Application Load Balancer with HTTPS listener terminates TLS at the load balancer, decrypting traffic, which violates the requirement that traffic must not be decrypted in transit.
C. ALB cannot properly handle gRPC with HTTP/2 and would decrypt TLS, failing the requirement to keep traffic encrypted end-to-end.
D. Targeting an Auto Scaling group rather than Pod IPs means traffic routes to nodes, not pods, causing inefficient routing and incompatibility with pod-level autoscaling.

Question 2

A company is deploying a new application in the AWS Cloud. The company wants a highly available web server that will sit behind an Elastic Load Balancer. The load balancer will route requests to multiple target groups based on the URL in the request. All traffic must use HTTPS. TLS processing must be offloaded to the load balancer. The web server must know the user's IP address so that the company can keep accurate logs for security purposes. Which solution will meet these requirements?

A. Deploy an Application Load Balancer with an HTTPS listener. Use path-based routing rules to forward the traffic to the correct target group. Include the X- Forwarded-For request header with traffic to the targets.
B. Deploy an Application Load Balancer with an HTTPS listener for each domain. Use host-based routing rules to forward the traffic to the correct target group for each domain. Include the X-Forwarded-For request header with traffic to the targets.
C. Deploy a Network Load Balancer with a TLS listener. Use path-based routing rules to forward the traffic to the correct target group. Configure client IP address preservation for traffic to the targets.
D. Deploy a Network Load Balancer with a TLS listener for each domain. Use host- based routing rules to forward the traffic to the correct target group for each domain. Configure client IP address preservation for traffic to the targets.

Show answer and explanation ▾

Correct answer: A

Deploy an Application Load Balancer with an HTTPS listener. Use path-based routing rules to forward the traffic to the correct target group. Include the X-Forwarded-For request header with traffic to the targets. An Application Load Balancer with an HTTPS listener supports TLS offloading and path- based routing rules to direct traffic to multiple target groups. The ALB automatically adds the X-Forwarded-For header containing the original client IP address, enabling accurate security logging while meeting all requirements.

Why the other options are wrong:

B. Host-based routing is unnecessary when the requirement specifies URL-based routing; using multiple HTTPS listeners is more complex than needed.
C. Network Load Balancer does not support path-based routing, and client IP preservation is not the standard mechanism for NLB-ALB with X-Forwarded-For is the correct approach.
D. NLB does not support path-based routing, and creating multiple TLS listeners for host-based routing is overly complex when ALB with URL/path routing is the appropriate solution.

Question 3

A company has developed an application on AWS that will track inventory levels of vending machines and initiate the restocking process automatically. The company plans to integrate this application with vending machines and deploy the vending machines in several markets around the world. The application resides in a VPC in the us-east-1 Region. The application consists of an Amazon Elastic Container Service (Amazon ECS) cluster behind an Application Load Balancer (ALB). The communication from the vending machines to the application happens over HTTPS. The company is planning to use an AWS Global Accelerator accelerator and configure static IP addresses of the accelerator in the vending machines for application endpoint access. The application must be accessible only through the accelerator and not through a direct connection over the internet to the ALB endpoint. Which solution will meet these requirements?

A. Configure the ALB in a private subnet of the VPC. Attach an internet gateway without adding routes in the subnet route tables to point to the internet gateway. Configure the accelerator with endpoint groups that include the ALB endpoint. Configure the ALB's security group to only allow inbound traffic from the internet on the ALB listener port.
B. Configure the ALB in a private subnet of the VPC. Configure the accelerator with endpoint groups that include the ALB endpoint. Configure the ALB's security group to only allow inbound traffic from the internet on the ALB listener port.
C. Configure the ALB in a public subnet of the VPC. Attach an internet gateway. Add routes in the subnet route tables to point to the internet gateway. Configure the accelerator with endpoint groups that include the ALB endpoint. Configure the ALB's security group to only allow inbound traffic from the accelerator's IP addresses on the ALB listener port.
D. Configure the ALB in a private subnet of the VPC. Attach an internet gateway. Add routes in the subnet route tables to point to the internet gateway. Configure the accelerator with endpoint groups that include the ALB endpoint. Configure the ALB's security group to only allow inbound traffic from the accelerator's IP addresses on the ALB listener port.

Show answer and explanation ▾

Correct answer: D

The ALB must be in a private subnet with an internet gateway and routes configured so the Global Accelerator can reach it. The ALB's security group must restrict inbound traffic to only the accelerator's IP address ranges on the listener port, ensuring the application is accessible only through Global Accelerator and not directly from the internet.

Why the other options are wrong:

A. An internet gateway without routes is non-functional; the configuration does not restrict access to the accelerator only, allowing direct internet access.
B. Without an internet gateway and routes, the Global Accelerator cannot reach the private ALB; this configuration is incomplete.
C. Placing the ALB in a public subnet defeats the purpose of restricting access to the accelerator only; direct internet access becomes possible.

Question 4

A global delivery company is modernizing its fleet management system. The company has several business units. Each business unit designs and maintains applications that are hosted in its own AWS account in separate application VPCs in the same AWS Region. Each business unit's applications are designed to get data from a central shared services VPC. The company wants the network connectivity architecture to provide granular security controls. The architecture also must be able to scale as more business units consume data from the central shared services VPC in the future. Which solution will meet these requirements in the MOST secure manner?

A. Create a central transit gateway. Create a VPC attachment to each application VPC. Provide full mesh connectivity between all the VPCs by using the transit gateway.
B. Create VPC peering connections between the central shared services VPC and each application VPC in each business unit's AWS account.
C. Create VPC endpoint services powered by AWS PrivateLink in the central shared services VPC. Create VPC endpoints in each application VPC.
D. Create a central transit VPC with a VPN appliance from AWS Marketplace. Create a VPN attachment from each VPC to the transit VPC. Provide full mesh connectivity among all the VPCs.

Show answer and explanation ▾

Correct answer: C

VPC endpoint services powered by AWS PrivateLink provide granular security controls through service-level permissions and do not require full mesh connectivity, enabling scalable architecture as more business units are added. Each business unit can independently create VPC endpoints to consume the central service with isolated, controlled access.

Why the other options are wrong:

A. Transit gateway with full mesh connectivity creates unnecessary exposure between all VPCs and lacks granular security controls between business units.
B. VPC peering does not scale efficiently and requires management of multiple peering relationships; it also provides less granular security control than PrivateLink.
D. A transit VPC with VPN appliances introduces unnecessary complexity and cost; VPN is not required for same-region VPC-to-VPC communication.

Question 5

A company uses a 4 Gbps AWS Direct Connect dedicated connection with a link aggregation group (LAG) bundle to connect to five VPCs that are deployed in the us- east-1 Region. Each VPC serves a different business unit and uses its own private VIF for connectivity to the on-premises environment. Users are reporting slowness when they access resources that are hosted on AWS. A network engineer finds that there are sudden increases in throughput and that the Direct Connect connection becomes saturated at the same time for about an hour each business day. The company wants to know which business unit is causing the sudden increase in throughput. The network engineer must find out this information and implement a solution to resolve the problem. Which solution will meet these requirements?

A. Review the Amazon CloudWatch metrics for VirtualInterfaceBpsEgress and VirtualInterfaceBpsIngress to determine which VIF is sending the highest throughput during the period in which slowness is observed. Create a new 10 Gbps dedicated connection. Shift traffic from the existing dedicated connection to the new dedicated connection.
B. Review the Amazon CloudWatch metrics for VirtualInterfaceBpsEgress and VirtualInterfaceBpsIngress to determine which VIF is sending the highest throughput during the period in which slowness is observed. Upgrade the bandwidth of the existing dedicated connection to 10 Gbps.
C. Review the Amazon CloudWatch metrics for ConnectionBpsIngress and ConnectionPpsEgress to determine which VIF is sending the highest throughput during the period in which slowness is observed. Upgrade the existing dedicated connection to a 5 Gbps hosted connection.
D. Review the Amazon CloudWatch metrics for ConnectionBpsIngress and ConnectionPpsEgress to determine which VIF is sending the highest throughput during the period in which slowness is observed. Create a new 10 Gbps dedicated connection. Shift traffic from the existing dedicated connection to the new dedicated connection.

Show answer and explanation ▾

Correct answer: A

CloudWatch metrics VirtualInterfaceBpsEgress and VirtualInterfaceBpsIngress are the correct metrics to identify which VIF (and thus which business unit) is consuming the most throughput during the slowness period. Upgrading to a 10 Gbps dedicated connection resolves the saturation issue while allowing identification of the offending business unit.

Why the other options are wrong:

B. While upgrading to 10 Gbps is a valid solution, the correct metrics are VirtualInterfaceBpsEgress/Ingress, not the ones mentioned.
C. ConnectionBpsIngress and ConnectionPpsEgress are not the appropriate metrics for per-VIF traffic analysis; downgrading to 5 Gbps would worsen the problem.
D. ConnectionBpsIngress and ConnectionPpsEgress are incorrect metrics for identifying which VIF is causing the issue.

Question 6

A banking company is successfully operating its public mobile banking stack on AWS. The mobile banking stack is deployed in a VPC that includes private subnets and public subnets. The company is using IPv4 networking and has not deployed or supported IPv6 in the environment. The company has decided to adopt a third-party service provider's API and must integrate the API with the existing environment. The service provider's API requires the use of IPv6. A network engineer must turn on IPv6 connectivity for the existing workload that is deployed in a private subnet. The company does not want to permit IPv6 traffic from the public internet and mandates that the company's servers must initiate all IPv6 connectivity. The network engineer turns on IPv6 in the VPC and in the private subnets. Which solution will meet these requirements?

A. Create an internet gateway and a NAT gateway in the VPC. Add a route to the existing subnet route tables to point IPv6 traffic to the NAT gateway.
B. Create an internet gateway and a NAT instance in the VPC. Add a route to the existing subnet route tables to point IPv6 traffic to the NAT instance.
C. Create an egress-only Internet gateway in the VPC. Add a route to the existing subnet route tables to point IPv6 traffic to the egress-only internet gateway.
D. Create an egress-only internet gateway in the VPC. Configure a security group that denies all inbound traffic. Associate the security group with the egress-only internet gateway.

Show answer and explanation ▾

Correct answer: C

Create an egress-only Internet gateway in the VPC. Add a route to the existing subnet route tables to point IPv6 traffic to the egress- only internet gateway. An egress-only internet gateway is specifically designed for IPv6 traffic in private subnets, allowing outbound-only connectivity while blocking all inbound traffic from the public internet. This perfectly matches the requirement that servers must initiate all IPv6 connectivity and no unsolicited inbound traffic is permitted. Adding a route to point IPv6 traffic to the egress-only internet gateway enables the private subnet resources to communicate with external IPv6 services (the third-party API) without exposing them to inbound internet traffic.

Why the other options are wrong:

A. NAT gateways do not support IPv6; they only work with IPv4 traffic.
B. NAT instances also do not support IPv6 traffic routing.
D. While an egress-only internet gateway is correct, associating a security group with it and denying inbound traffic is redundant since egress-only gateways inherently block inbound traffic; the routing configuration in option C is the proper solution.

Question 7

A company has deployed an AWS Network Firewall firewall into a VPC. A network engineer needs to implement a solution to deliver Network Firewall flow logs to the company's Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster in the shortest possible time. Which solution will meet these requirements?

A. Create an Amazon S3 bucket. Create an AWS Lambda function to load logs into the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster. Enable Amazon Simple Notification Service (Amazon SNS) notifications on the S3 bucket to invoke the Lambda function. Configure flow logs for the firewall. Set the S3 bucket as the destination.
B. Create an Amazon Kinesis Data Firehose delivery stream that includes the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster as the destination. Configure flow logs for the firewall Set the Kinesis Data Firehose delivery stream as the destination for the Network Firewall flow logs.
C. Configure flow logs for the firewall. Set the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster as the destination for the Network Firewall flow logs.
D. Create an Amazon Kinesis data stream that includes the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster as the destination. Configure flow logs for the firewall. Set the Kinesis data stream as the destination for the Network Firewall flow logs.

Show answer and explanation ▾

Correct answer: B

Amazon Kinesis Data Firehose is purpose-built for real-time log delivery to analytics services like Amazon OpenSearch, providing the shortest latency for log ingestion. Firehose automatically handles buffering, compression, and transformation, delivering logs to OpenSearch with minimal delay. Network Firewall flow logs can be configured to send directly to a Firehose delivery stream, making this the most efficient path with no intermediate processing required.

Why the other options are wrong:

A. This solution introduces unnecessary latency through S3 and Lambda processing stages rather than delivering logs in near real-time.
C. Network Firewall cannot deliver flow logs directly to OpenSearch; logs must be sent to CloudWatch Logs, S3, or Kinesis first.
D. While Kinesis Data Streams can work, it requires additional Lambda consumer logic to push to OpenSearch, adding latency compared to Firehose's native integration.

Question 8

An ecommerce company is hosting a web application on Amazon EC2 instances to handle continuously changing customer demand. The EC2 instances are part of an Auto Scaling group. The company wants to implement a solution to distribute traffic from customers to the EC2 instances. The company must encrypt all traffic at all stages between the customers and the application servers. No decryption at intermediate points is allowed. Which solution will meet these requirements?

A. Create an Application Load Balancer (ALB). Add an HTTPS listener to the ALB. Configure the Auto Scaling group to register instances with the ALB's target group.
B. Create an Amazon CloudFront distribution. Configure the distribution with a custom SSL/TLS certificate. Set the Auto Scaling group as the distribution's origin.
C. Create a Network Load Balancer (NLB). Add a TCP listener to the NLB. Configure the Auto Scaling group to register instances with the NLB's target group.
D. Create a Gateway Load Balancer (GLB). Configure the Auto Scaling group to register instances with the GLB's target group.

Show answer and explanation ▾

Correct answer: C

A Network Load Balancer with a TCP listener on port 443 performs no decryption at the load balancer layer; it simply forwards encrypted traffic end-to-end to the EC2 instances. The encryption occurs between the client and the EC2 instance, with no intermediate decryption. This meets the strict requirement of no decryption at any intermediate point.

Why the other options are wrong:

A. An ALB with HTTPS listener terminates the TLS connection at the ALB, decrypting traffic there before re-encrypting to the backend, which violates the no-decryption requirement.
B. CloudFront decrypts traffic at the edge location before re-encrypting to the origin, violating the no-intermediate-decryption requirement.
D. A Gateway Load Balancer is designed for third-party virtual appliances and security services, not for distributing traffic to standard web application servers.

Question 9

A company has two on-premises data center locations. There is a company-managed router at each data center. Each data center has a dedicated AWS Direct Connect connection to a Direct Connect gateway through a private virtual interface. The router for the first location is advertising 110 routes to the Direct Connect gateway by using BGP, and the router for the second location is advertising 60 routes to the Direct Connect gateway by using BGP. The Direct Connect gateway is attached to a company VPC through a virtual private gateway. A network engineer receives reports that resources in the VPC are not reachable from various locations in either data center. The network engineer checks the VPC route table and sees that the routes from the first data center location are not being populated into the route table. The network engineer must resolve this issue in the most operationally efficient manner. What should the network engineer do to meet these requirements?

A. Remove the Direct Connect gateway, and create a new private virtual interface from each company router to the virtual private gateway of the VPC.
B. Change the router configurations to summarize the advertised routes.
C. Open a support ticket to increase the quota on advertised routes to the VPC route table.
D. Create an AWS Transit Gateway. Attach the transit gateway to the VPC, and connect the Direct Connect gateway to the transit gateway.

Show answer and explanation ▾

Correct answer: B

The issue is that the first location is advertising 110 routes, which exceeds the VPC route table limit of 100 routes from a single BGP speaker. By configuring route summarization (aggregation) on the router, the 110 routes can be consolidated into fewer aggregate prefixes, bringing the total below the 100-route limit. This is the most operationally efficient solution as it doesn't require infrastructure changes and resolves the root cause of the problem.

Why the other options are wrong:

A. Removing the Direct Connect gateway and creating multiple private virtual interfaces would be more complex and operationally inefficient than route summarization.
C. There is no quota increase available for the number of BGP-advertised routes to a VPC; 100 routes is a hard limit that cannot be exceeded through quota increases.
D. A Transit Gateway is not necessary to resolve this route limit issue and would add unnecessary complexity; route summarization is the proper solution.

Question 10

A company has multiple AWS accounts. Each account contains one or more VPCs. A new security guideline requires the inspection of all traffic between VPCs. The company has deployed a transit gateway that provides connectivity between all VPCs. The company also has deployed a shared services VPC with Amazon EC2 instances that include IDS services for stateful inspection. The EC2 instances are deployed across three Availability Zones. The company has set up VPC associations and routing on the transit gateway. The company has migrated a few test VPCs to the new solution for traffic inspection. Soon after the configuration of routing, the company receives reports of intermittent connections for traffic that crosses Availability Zones. What should a network engineer do to resolve this issue?

A. Modify the transit gateway VPC attachment on the shared services VPC by enabling cross-Availability Zone load balancing.
B. Modify the transit gateway VPC attachment on the shared services VPC by enabling appliance mode support.
C. Modify the transit gateway by selecting VPN equal-cost multi-path (ECMP) routing support.
D. Modify the transit gateway by selecting multicast support.

Show answer and explanation ▾

Correct answer: B

Intermittent cross-Availability Zone connections with stateful inspection indicate that traffic is not consistently returning through the same availability zone. Appliance mode support on the transit gateway attachment ensures symmetric routing by disabling the learning of MAC addresses and maintaining flow affinity, so return traffic exits through the same inspection appliance in the same AZ where the inbound traffic entered. This resolves the connection flakiness caused by asymmetric return paths.

Why the other options are wrong:

A. Cross-AZ load balancing on a transit gateway attachment is not a standard feature and does not address the stateful inspection symmetry issue.
C. ECMP routing support helps with equal-cost multi-path selection but does not guarantee symmetry for stateful inspection, which requires appliance mode.
D. Multicast support is unrelated to the problem of intermittent cross-AZ connections with IDS services.

Question 11

An international company provides early warning about tsunamis. The company plans to use IoT devices to monitor sea waves around the world. The data that is collected by the IoT devices must reach the company's infrastructure on AWS as quickly as possible. The company is using three operation centers around the world. Each operation center is connected to AWS through Its own AWS Direct Connect connection. Each operation center is connected to the internet through at least two upstream internet service providers. The company has its own provider-independent (PI) address space. The IoT devices use TCP protocols for reliable transmission of the data they collect. The IoT devices have both landline and mobile internet connectivity. The infrastructure and the solution will be deployed in multiple AWS Regions. The company will use Amazon Route 53 for DNS services. A network engineer needs to design connectivity between the IoT devices and the services that run in the AWS Cloud. Which solution will meet these requirements with the HIGHEST availability?

A. Set up an Amazon CloudFront distribution with origin failover. Create an origin group for each Region where the solution is deployed.
B. Set up Route 53 latency-based routing. Add latency alias records. For the latency alias records, set the value of Evaluate Target Health to Yes.
C. Set up an accelerator in AWS Global Accelerator. Configure Regional endpoint groups and health checks.
D. Set up Bring Your Own IP (BYOIP) addresses. Use the same PI addresses for each Region where the solution is deployed.

Show answer and explanation ▾

Correct answer: C

AWS Global Accelerator with regional endpoint groups and health checks provides the highest availability for IoT devices distributed globally. It uses Anycast IP addresses to route traffic to the nearest healthy endpoint, supports failover across regions, works with both TCP and UDP protocols, and integrates with the company's three operation centers and multiple ISP connectivity. The solution leverages the Direct Connect connections while providing automatic failover and traffic steering based on health checks.

Why the other options are wrong:

A. CloudFront is designed for content delivery (HTTP/HTTPS), not for reliable TCP- based IoT data ingestion.
B. Latency-based routing alone does not provide sufficient failover capability; health checks help but don't match Global Accelerator's traffic engineering features.
D. BYOIP addresses enable custom IP space but do not provide routing, failover, or traffic steering capabilities needed for high availability.

Question 12

A company is planning a migration of its critical workloads from an on-premises data center to Amazon EC2 instances. The plan includes a new 10 Gbps AWS Direct Connect dedicated connection from the on-premises data center to a VPC that is attached to a transit gateway. The migration must occur over encrypted paths between the on-premises data center and the AWS Cloud. Which solution will meet these requirements while providing the HIGHEST throughput?

A. Configure a public VIF on the Direct Connect connection. Configure an AWS Site- to-Site VPN connection to the transit gateway as a VPN attachment.
B. Configure a transit VIF on the Direct Connect connection. Configure an IPsec VPN connection to an EC2 instance that is running third-party VPN software.
C. Configure MACsec for the Direct Connect connection. Configure a transit VIF to a Direct Connect gateway that is associated with the transit gateway.
D. Configure a public VIF on the Direct Connect connection. Configure two AWS Site-to-Site VPN connections to the transit gateway. Enable equal-cost multi-path (ECMP) routing.

Show answer and explanation ▾

Correct answer: C

MACsec encryption on the Direct Connect connection combined with a transit VIF provides encrypted communication while preserving the full 10 Gbps throughput. Unlike Site-to-Site VPN which adds IPsec overhead and reduces throughput, MACsec operates at Layer 2 and does not significantly impact performance. The transit VIF to the Direct Connect gateway supports the transit gateway attachment, meeting all encryption and throughput requirements.

Why the other options are wrong:

A. Public VIF with Site-to-Site VPN adds IPsec encryption overhead, reducing throughput below the 10 Gbps requirement.
B. Transit VIF with third-party VPN software on an EC2 instance creates a bottleneck and increases operational complexity compared to native AWS solutions.
D. Public VIF with multiple VPN connections uses IPsec which adds encryption overhead; ECMP cannot overcome the inherent throughput limitations of VPN encryption.

Question 13

A network engineer must develop an AWS CloudFormation template that can create a virtual private gateway, a customer gateway, a VPN connection, and static routes in a route table. During testing of the template, the network engineer notes that the CloudFormation template has encountered an error and is rolling back. What should the network engineer do to resolve the error?

A. Change the order of resource creation in the CloudFormation template.
B. Add the DependsOn attribute to the resource declaration for the virtual private gateway. Specify the route table entry resource.
C. Add a wait condition in the template to wait for the creation of the virtual private gateway.
D. Add the DependsOn attribute to the resource declaration for the route table entry. Specify the virtual private gateway resource.

Show answer and explanation ▾

Correct answer: D

Route table entries depend on the virtual private gateway existing first. By adding the DependsOn attribute to the route table entry resource and specifying the virtual private gateway resource, CloudFormation will create the gateway before attempting to create the static routes, preventing rollback due to missing dependencies.

Why the other options are wrong:

A. CloudFormation has built-in dependency resolution; manual ordering is not needed and won't fix underlying resource dependency issues.
B. The virtual private gateway does not depend on route table entries; the reverse dependency is correct.
C. Wait conditions are not the appropriate mechanism for resolving resource creation order; explicit DependsOn attributes are the proper CloudFormation solution.

Question 14

A company's network engineer needs to design a new solution to help troubleshoot and detect network anomalies. The network engineer has configured Traffic Mirroring. However, the mirrored traffic is overwhelming the Amazon EC2 instance that is the traffic mirror target. The EC2 instance hosts tools that the company's security team uses to analyze the traffic. The network engineer needs to design a highly available solution that can scale to meet the demand of the mirrored traffic. Which solution will meet these requirements?

A. Deploy a Network Load Balancer (NLB) as the traffic mirror target. Behind the NLB. deploy a fleet of EC2 instances in an Auto Scaling group. Use Traffic Mirroring as necessary.
B. Deploy an Application Load Balancer (ALB) as the traffic mirror target. Behind the ALB, deploy a fleet of EC2 instances in an Auto Scaling group. Use Traffic Mirroring only during non-business hours.
C. Deploy a Gateway Load Balancer (GLB) as the traffic mirror target. Behind the GLB. deploy a fleet of EC2 instances in an Auto Scaling group. Use Traffic Mirroring as necessary.
D. Deploy an Application Load Balancer (ALB) with an HTTPS listener as the traffic mirror target. Behind the ALB. deploy a fleet of EC2 instances in an Auto Scaling group. Use Traffic Mirroring only during active events or business hours.

Show answer and explanation ▾

Correct answer: A

A Network Load Balancer as the traffic mirror target with an Auto Scaling group of EC2 instances provides high availability, automatic scaling to handle mirrored traffic volume, and maintains Layer 4 throughput necessary for traffic analysis tools. The NLB can distribute mirrored traffic across multiple analysis instances, preventing overwhelming any single instance while remaining highly available across AZs.

Why the other options are wrong:

B. ALBs operate at Layer 7 and are not suitable for traffic mirroring which requires Layer 4 handling; restricting analysis to non-business hours defeats the purpose of real-time anomaly detection.
C. Gateway Load Balancers are designed for third-party appliances in the data path but are not the appropriate choice for scaling analysis tools receiving mirrored traffic.
D. ALBs with HTTPS are Layer 7 and unsuitable for mirrored traffic; restricting to business hours prevents detection of anomalies during off-hours when attacks may occur.

Question 15

A company has deployed Amazon EC2 instances in private subnets in a VPC. The EC2 instances must initiate any requests that leave the VPC, including requests to the company's on-premises data center over an AWS Direct Connect connection. No resources outside the VPC can be allowed to open communications directly to the EC2 instances. The on-premises data center's customer gateway is configured with a stateful firewall device that filters for incoming and outgoing requests to and from multiple VPCs. In addition, the company wants to use a single IP match rule to allow all the communications from the EC2 instances to its data center from a single IP address. Which solution will meet these requirements with the LEAST amount of operational overhead?

A. Create a VPN connection over the Direct Connect connection by using the on- premises firewall. Use the firewall to block all traffic from on premises to AWS. Allow a stateful connection from the EC2 instances to initiate the requests.
B. Configure the on-premises firewall to filter all requests from the on-premises network to the EC2 instances. Allow a stateful connection if the EC2 instances in the VPC initiate the traffic.
C. Deploy a NAT gateway into a private subnet in the VPC where the EC2 instances are deployed. Specify the NAT gateway type as private. Configure the on-premises firewall to allow connections from the IP address that is assigned to the NAT gateway.
D. Deploy a NAT instance into a private subnet in the VPC where the EC2 instances are deployed. Configure the on-premises firewall to allow connections from the IP address that is assigned to the NAT instance.

Show answer and explanation ▾

Correct answer: C

A private NAT gateway provides a single IP address for all outbound communications from EC2 instances to the data center, requiring only one firewall rule. It maintains stateful connections (allowing only EC2-initiated traffic) while operating in a private subnet, meeting all requirements with minimal operational overhead. Private NAT gateways are fully managed AWS services requiring no instance management.

Why the other options are wrong:

A. VPN over Direct Connect adds unnecessary complexity and doesn't provide the single-IP requirement for firewall rules.
B. Relying on firewall stateful inspection alone requires complex rules and doesn't provide the single-source-IP requirement.
D. NAT instances require manual configuration, patching, and management, creating higher operational overhead than the managed private NAT gateway service.

Question 16

A global company operates all its non-production environments out of three AWS Regions: eu-west-1, us-east-1, and us-west-1. The company hosts all its production workloads in two on-premises data centers. The company has 60 AWS accounts and each account has two VPCs in each Region. Each VPC has a virtual private gateway where two VPN connections terminate for resilient connectivity to the data centers. The company has 360 VPN tunnels to each data center, resulting in high management overhead. The total VPN throughput for each Region is 500 Mbps. The company wants to migrate the production environments to AWS. The company needs a solution that will simplify the network architecture and allow for future growth. The production environments will generate an additional 2 Gbps of traffic per Region back to the data centers. This traffic will increase over time. Which solution will meet these requirements?

A. Set up an AWS Direct Connect connection from each data center to AWS in each Region. Create and attach private VIFs to a single Direct Connect gateway. Attach the Direct Connect gateway to all the VPCs. Remove the existing VPN connections that are attached directly to the virtual private gateways.
B. Create a single transit gateway with VPN connections from each data center. Share the transit gateway with each account by using AWS Resource Access Manager (AWS RAM). Attach the transit gateway to each VPC. Remove the existing VPN connections that are attached directly to the virtual private gateways.
C. Create a transit gateway in each Region with multiple newly commissioned VPN connections from each data center. Share the transit gateways with each account by using AWS Resource Access Manager (AWS RAM). In each Region, attach the transit gateway to each VPC. Remove the existing VPN connections that are attached directly to the virtual private gateways.
D. Peer all the VPCs in each Region to a new VPC in each Region that will function as a centralized transit VPC. Create new VPN connections from each data center to the transit VPCs. Terminate the original VPN connections that are attached to all the original VPCs. Retain the new VPN connection to the new transit VPC in each Region.

Show answer and explanation ▾

Correct answer: C

Option C is correct because it uses a transit gateway in each region with multiple VPN connections, which consolidates the 360 VPN tunnels into a manageable architecture. By sharing the transit gateway via AWS RAM across all 60 accounts, the solution eliminates direct VPN attachments to individual VPCs while supporting the required 2 Gbps of additional traffic per region and providing scalability for future growth. Transit gateways with multiple VPN connections provide better throughput (up to 50 Gbps per attachment) compared to the current 500 Mbps limit.

Why the other options are wrong:

A. Direct Connect requires significant provisioning time and cannot be implemented within the typical timeline; it also doesn't address the complexity of managing connections across 60 accounts as effectively as transit gateway sharing.
B. Creating a single transit gateway per region with only two VPN connections (one per data center) limits throughput and scalability; multiple VPN connections per region are needed to handle the additional 2 Gbps traffic requirement.
D. VPC peering to a transit VPC doesn't scale well with 60 accounts and still requires complex routing; it doesn't provide the same management simplification or throughput capacity as a transit gateway solution.

Question 17

A company is building its website on AWS in a single VPC. The VPC has public subnets and private subnets in two Availability Zones. The website has static content such as images. The company is using Amazon S3 to store the content. The company has deployed a fleet of Amazon EC2 instances as web servers in a private subnet. The EC2 instances are in an Auto Scaling group behind an Application Load Balancer. The EC2 instances will serve traffic, and they must pull content from an S3 bucket to render the webpages. The company is using AWS Direct Connect with a public VIF for on-premises connectivity to the S3 bucket. A network engineer notices that traffic between the EC2 instances and Amazon S3 is routing through a NAT gateway. As traffic increases, the company's costs are increasing. The network engineer needs to change the connectivity to reduce the NAT gateway costs that result from the traffic between the EC2 instances and Amazon S3. Which solution will meet these requirements?

A. Create a Direct Connect private VIF. Migrate the traffic from the public VIF to the private VIF.
B. Create an AWS Site-to-Site VPN tunnel over the existing public VIF.
C. Implement interface VPC endpoints for Amazon S3. Update the VPC route table.
D. Implement gateway VPC endpoints for Amazon S3. Update the VPC route table.

Show answer and explanation ▾

Correct answer: D

Option D is correct because gateway VPC endpoints for Amazon S3 allow EC2 instances in private subnets to access S3 without routing traffic through a NAT gateway. Gateway endpoints are free, integrate seamlessly with route tables, and eliminate the data transfer charges associated with NAT gateway usage. This directly reduces operational costs while maintaining secure connectivity to S3.

Why the other options are wrong:

A. Direct Connect private VIFs are designed for on-premises connectivity, not for internal AWS service access; this would not reduce NAT gateway costs.
B. Site-to-Site VPN would add unnecessary complexity and cost without solving the NAT gateway routing issue.
C. Interface VPC endpoints for S3 require an ENI and incur hourly charges, making them more expensive than gateway endpoints; they are not the optimal choice for cost reduction.

Question 18

A company wants to improve visibility into its AWS environment. The AWS environment consists of multiple VPCs that are connected to a transit gateway. The transit gateway connects to an on-premises data center through an AWS Direct Connect gateway and a pair of redundant Direct Connect connections that use transit VIFs. The company must receive notification each time a new route is advertised to AWS from on premises over Direct Connect. What should a network engineer do to meet these requirements?

A. Enable Amazon CloudWatch metrics on Direct Connect to track the received routes. Configure a CloudWatch alarm to send notifications when routes change.
B. Onboard Transit Gateway Network Manager to Amazon CloudWatch Logs Insights. Use Amazon EventBridge (Amazon CloudWatch Events) to send notifications when routes change.
C. Configure an AWS Lambda function to periodically check the routes on the Direct Connect gateway and to send notifications when routes change.
D. Enable Amazon CloudWatch Logs on the transit VIFs to track the received routes. Create a metric filter Set an alarm on the filter to send notifications when routes change.

Show answer and explanation ▾

Correct answer: B

Option B is correct because Transit Gateway Network Manager provides native integration with AWS tools for monitoring route changes. By onboarding Network Manager to CloudWatch Logs Insights, engineers can query and analyze route advertisements. Using EventBridge to trigger notifications when routes change provides automated alerting without requiring custom development or polling mechanisms.

Why the other options are wrong:

A. CloudWatch metrics on Direct Connect do not specifically track individual route advertisements; CloudWatch alarms cannot detect specific route changes.
C. Lambda polling is operationally inefficient and does not provide real-time notifications compared to event-driven approaches.
D. CloudWatch Logs on transit VIFs do not provide route change tracking; metric filters cannot reliably detect route advertisement events.

Question 19

A software company offers a software-as-a-service (SaaS) accounting application that is hosted in the AWS Cloud The application requires connectivity to the company's on- premises network. The company has two redundant 10 GB AWS Direct Connect connections between AWS and its on-premises network to accommodate the growing demand for the application. The company already has encryption between its on-premises network and the colocation. The company needs to encrypt traffic between AWS and the edge routers in the colocation within the next few months. The company must maintain its current bandwidth. What should a network engineer do to meet these requirements with the LEAST operational overhead?

A. Deploy a new public VIF with encryption on the existing Direct Connect connections. Reroute traffic through the new public VIF.
B. Create a virtual private gateway Deploy new AWS Site-to-Site VPN connections from on premises to the virtual private gateway Reroute traffic from the Direct Connect private VIF to the new VPNs.
C. Deploy a new pair of 10 GB Direct Connect connections with MACsec. Configure MACsec on the edge routers. Reroute traffic to the new Direct Connect connections. Decommission the original Direct Connect connections
D. Deploy a new pair of 10 GB Direct Connect connections with MACsec. Deploy a new public VIF on the new Direct Connect connections. Deploy two AWS Site-to-Site VPN connections on top of the new public VIF. Reroute traffic from the existing private VIF to the new Site-to-Site connections. Decommission the original Direct Connect connections.

Show answer and explanation ▾

Correct answer: C

Option C is correct because MACsec (Media Access Control Security) can be deployed on existing Direct Connect connections or new dedicated connections to provide Layer 2 encryption. Deploying a new pair of 10 GB Direct Connect connections with MACsec enabled and configuring MACsec on the edge routers maintains the current 10 GB bandwidth while encrypting traffic between AWS and the colocation with minimal operational overhead compared to alternatives.

Why the other options are wrong:

A. Public VIFs do not support encryption; this would not meet the encryption requirement.
B. Migrating to Site-to-Site VPN would reduce bandwidth capacity and throughput, potentially impacting performance.
D. Adding VPN connections on top of public VIFs introduces unnecessary complexity and potential performance degradation without providing the direct encryption benefit of MACsec.

Question 20

A company hosts an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company recently experienced a network security breach. A network engineer must collect and analyze logs that include the client IP address, target IP address, target port, and user agent of each user that accesses the application. What is the MOST operationally efficient solution that meets these requirements?

A. Configure the ALB to store logs in an Amazon S3 bucket. Download the files from Amazon S3, and use a spreadsheet application to analyze the logs.
B. Configure the ALB to push logs to Amazon Kinesis Data Streams. Use Amazon Kinesis Data Analytics to analyze the logs.
C. Configure Amazon Kinesis Data Streams to stream data from the ALB to Amazon OpenSearch Service (Amazon Elasticsearch Service). Use search operations in Amazon OpenSearch Service (Amazon Elasticsearch Service) to analyze the data.
D. Configure the ALB to store logs in an Amazon S3 bucket. Use Amazon Athena to analyze the logs in Amazon S3.

Show answer and explanation ▾

Correct answer: D

Option D is correct because ALB access logs stored in S3 contain all required fields (client IP, target IP, target port, and user agent), and Amazon Athena provides SQL-based querying of S3 data without requiring data download or manual spreadsheet analysis. This approach is operationally efficient, scalable, and cost-effective for analyzing application access patterns.

Why the other options are wrong:

A. Downloading logs and using spreadsheet applications is not scalable and requires manual analysis, making it operationally inefficient.
B. Kinesis Data Streams requires ALB to be configured to push logs directly, which is not a native ALB feature; this would require additional setup.
C. OpenSearch requires streaming data transformation and management overhead; it is more complex than necessary for simple log analysis of ALB access logs.

Question 21

A company is hosting an application on Amazon EC2 instances behind a Network Load Balancer (NLB). A solutions architect added EC2 instances in a second Availability Zone to improve the availability of the application. The solutions architect added the instances to the NLB target group. The company's operations team notices that traffic is being routed only to the instances in the first Availability Zone. What is the MOST operationally efficient solution to resolve this issue?

A. Enable the new Availability Zone on the NLB
B. Create a new NLB for the instances in the second Availability Zone
C. Enable proxy protocol on the NLB
D. Create a new target group with the instances in both Availability Zones

Show answer and explanation ▾

Correct answer: A

Option A is correct because Network Load Balancers must have target Availability Zones explicitly enabled to distribute traffic across them. When new instances are added in a second Availability Zone, the NLB must be reconfigured to enable that Availability Zone, allowing it to route traffic to instances in both zones. This is the native, operationally efficient solution provided by AWS.

Why the other options are wrong:

B. Creating a separate NLB adds unnecessary complexity and management overhead; a single NLB can serve multiple Availability Zones.
C. Proxy protocol is for preserving client IP information in connections; it does not affect Availability Zone traffic distribution.
D. Creating a new target group does not solve the core issue; the existing target group should work once the Availability Zone is enabled on the NLB.

Question 22

A network engineer needs to set up an Amazon EC2 Auto Scaling group to run a Linux- based network appliance in a highly available architecture. The network engineer is configuring the new launch template for the Auto Scaling group. In addition to the primary network interface the network appliance requires a second network interface that will be used exclusively by the application to exchange traffic with hosts over the internet. The company has set up a Bring Your Own IP (BYOIP) pool that includes an Elastic IP address that should be used as the public IP address for the second network interface. How can the network engineer implement the required architecture?

A. Configure the two network interfaces in the launch template. Define the primary network interface to be created in one of the private subnets. For the second network interface, select one of the public subnets. Choose the BYOIP pool ID as the source of public IP addresses.
B. Configure the primary network interface in a private subnet in the launch template. Use the user data option to run a cloud-init script after boot to attach the second network interface from a subnet with auto-assign public IP addressing enabled.
C. Create an AWS Lambda function to run as a lifecycle hook of the Auto Scaling group when an instance is launching. In the Lambda function, assign a network interface to an AWS Global Accelerator endpoint.
D. During creation of the Auto Scaling group, select subnets for the primary network interface. Use the user data option to run a cloud-init script to allocate a second network interface and to associate an Elastic IP address from the BYOIP pool.

Show answer and explanation ▾

Correct answer: D

Option D is correct because it uses user data with a cloud-init script to attach the second network interface and associate an Elastic IP from the BYOIP pool after instance launch. This approach works within the Auto Scaling group's launch template constraints and allows the instance to dynamically acquire the secondary interface and BYOIP Elastic IP address upon boot, supporting the highly available architecture requirement.

Why the other options are wrong:

A. Launch templates cannot reference BYOIP pool IDs for secondary network interfaces; BYOIP addresses must be allocated before instance launch.
B. Attaching network interfaces via user data after boot is possible but does not guarantee the BYOIP Elastic IP association will occur correctly without additional scripting complexity.
C. Using Lambda with a lifecycle hook and Global Accelerator adds unnecessary complexity; Global Accelerator is not suitable for per-instance IP assignment in this context.

Question 23

A company is deploying an application. The application is implemented in a series of containers in an Amazon Elastic Container Service (Amazon ECS) cluster. The company will use the Fargate launch type for its tasks. The containers will run workloads that require connectivity initiated over an SSL connection. Traffic must be able to flow to the application from other AWS accounts over private connectivity. The application must scale in a manageable way as more consumers use the application. Which solution will meet these requirements?

A. Choose a Gateway Load Balancer (GLB) as the type of load balancer for the ECS service. Create a lifecycle hook to add new tasks to the target group from Amazon ECS as required to handle scaling. Specify the GLB in the service definition. Create a VPC peer for external AWS accounts. Update the route tables so that the AWS accounts can reach the GLB.
B. Choose an Application Load Balancer (ALB) as the type of load balancer for the ECS service. Create path-based routing rules to allow the application to target the containers that are registered in the target group. Specify the ALB in the service definition. Create a VPC endpoint service for the ALB Share the VPC endpoint service with other AWS accounts.
C. Choose an Application Load Balancer (ALB) as the type of load balancer for the ECS service. Create path-based routing rules to allow the application to target the containers that are registered in the target group. Specify the ALB in the service definition. Create a VPC peer for the external AWS accounts. Update the route tables so that the AWS accounts can reach the ALB.
D. Choose a Network Load Balancer (NLB) as the type of load balancer for the ECS service. Specify the NLB in the service definition. Create a VPC endpoint service for the NLB. Share the VPC endpoint service with other AWS accounts.

Show answer and explanation ▾

Correct answer: D

A Network Load Balancer (NLB) is optimal for SSL/TLS workloads requiring low-latency, high-throughput connectivity. By creating a VPC endpoint service for the NLB and sharing it with other AWS accounts, consumers from external accounts can establish private connectivity through interface endpoints without exposing the service to the internet or requiring VPC peering. This provides managed, scalable access across account boundaries while maintaining security through private connectivity.

Why the other options are wrong:

A. Gateway Load Balancers are designed for third-party virtual appliances and packet inspection, not application delivery. Lifecycle hooks are not the proper mechanism for ECS task scaling.
B. ALBs are designed for HTTP/HTTPS with application-layer routing, not SSL connections at the transport layer, and are less suitable than NLBs for this use case.
C. VPC peering between accounts requires manual route table management and is less scalable than VPC endpoint services; ALBs also lack NLB's SSL/TLS performance characteristics.

Question 24

A company's development team has created a new product recommendation web service. The web service is hosted in a VPC with a CIDR block of 192.168.224.0/19. The company has deployed the web service on Amazon EC2 instances and has configured an Auto Scaling group as the target of a Network Load Balancer (NLB). The company wants to perform testing to determine whether users who receive product recommendations spend more money than users who do not receive product recommendations. The company has a big sales event in 5 days and needs to integrate its existing production environment with the recommendation engine by then. The existing production environment is hosted in a VPC with a CIDR block of 192.168.128 0/17. A network engineer must integrate the systems by designing a solution that results in the least possible disruption to the existing environments. Which solution will meet these requirements?

A. Create a VPC peering connection between the web service VPC and the existing production VPC. Add a routing rule to the appropriate route table to allow data to flow to 192.168.224.0/19 from the existing production environment and to flow to 192.168.128.0/17 from the web service environment. Configure the relevant security groups and ACLs to allow the systems to communicate.
B. Ask the development team of the web service to redeploy the web service into the production VPC and integrate the systems there.
C. Create a VPC endpoint service. Associate the VPC endpoint service with the NLB for the web service. Create an interface VPC endpoint for the web service in the existing production VPC.
D. Create a transit gateway in the existing production environment. Create attachments to the production VPC and the web service VPC. Configure appropriate routing rules in the transit gateway and VPC route tables for 192.168.224.0/19 and 192.168.128.0/17. Configure the relevant security groups and ACLs to allow the systems to communicate.

Show answer and explanation ▾

Correct answer: C

A VPC endpoint service created for the NLB provides the least disruptive integration path. The recommendation engine VPC exposes its NLB through an endpoint service, and the production VPC creates an interface endpoint to access it. This requires no changes to routing, transit infrastructure, or existing peering-only configuration of the endpoint service and endpoint itself. This allows testing and evaluation without architectural changes to either environment, making it ideal for the tight 5-day timeline.

Why the other options are wrong:

A. VPC peering requires bidirectional routing configuration and security group/ACL updates in both environments, causing more operational overhead and risk of misconfiguration.
B. Redeploying into production creates maximum disruption, defeats the purpose of isolated testing, and adds deployment complexity with tight timelines.
D. Transit gateways are over-engineered for a temporary integration testing scenario and require more configuration complexity than necessary, violating the "least disruption" requirement.

Question 25

A network engineer needs to update a company's hybrid network to support IPv6 for the upcoming release of a new application. The application is hosted in a VPC in the AWS Cloud. The company's current AWS infrastructure includes VPCs that are connected by a transit gateway. The transit gateway is connected to the on-premises network by AWS Direct Connect and AWS Site-to-Site VPN. The company's on-premises devices have been updated to support the new IPv6 requirements. The company has enabled IPv6 for the existing VPC by assigning a new IPv6 CIDR block to the VPC and by assigning IPv6 to the subnets for dual-stack support. The company has launched new Amazon EC2 instances for the new application in the updated subnets. When updating the hybrid network to support IPv6 the network engineer must avoid making any changes to the current infrastructure. The network engineer also must block direct access to the instances' new IPv6 addresses from the internet. However, the network engineer must allow outbound internet access from the instances. What is the MOST operationally efficient solution that meets these requirements?

A. Update the Direct Connect transit VIF and configure BGP peering with the AWS assigned IPv6 peering address. Create a new VPN connection that supports IPv6 connectivity. Add an egress-only internet gateway. Update any affected VPC security groups and route tables to provide connectivity within the VPC and between the VPC and the on-premises devices
B. Update the Direct Connect transit VIF and configure BGP peering with the AWS assigned IPv6 peering address. Update the existing VPN connection to support IPv6 connectivity. Add an egress-only internet gateway. Update any affected VPC security groups and route tables to provide connectivity within the VPC and between the VPC and the on-premises devices.
C. Create a Direct Connect transit VIF and configure BGP peering with the AWS assigned IPv6 peering address. Create a new VPN connection that supports IPv6 connectivity. Add an egress-only internet gateway. Update any affected VPC security groups and route tables to provide connectivity within the VPC and between the VPC and the on-premises devices.
D. Create a Direct Connect transit VIF and configure BGP peering with the AWS assigned IPv6 peering address. Create a new VPN connection that supports IPv6 connectivity. Add a NAT gateway. Update any affected VPC security groups and route tables to provide connectivity within the VPC and between the VPC and the on- premises devices.

Show answer and explanation ▾

Correct answer: A

To add IPv6 support while avoiding changes to existing infrastructure, update the existing Direct Connect transit VIF with IPv6 BGP peering (not create a new one, as that would modify existing infrastructure). Create a new VPN connection specifically for IPv6 support, keeping the existing VPN unchanged. Add an egress-only internet gateway to allow outbound IPv6 traffic while blocking inbound internet access to instances. This approach minimizes changes to production connections while enabling the new IPv6 application requirements.

Why the other options are wrong:

B. Updating the existing VPN connection modifies current infrastructure against stated requirements; a new VPN is needed for IPv6 without touching the existing one.
C. Creating (not updating) a new Direct Connect VIF violates the requirement to avoid changes to current infrastructure; the existing VIF must be updated.
D. NAT gateways do not work with IPv6; egress-only internet gateways are the correct mechanism for outbound-only IPv6 connectivity.

Question 26

A network engineer must provide additional safeguards to protect encrypted data at Application Load Balancers (ALBs) through the use of a unique random session key. What should the network engineer do to meet this requirement?

A. Change the ALB security policy to a policy that supports TLS 1.2 protocol only
B. Use AWS Key Management Service (AWS KMS) to encrypt session keys
C. Associate an AWS WAF web ACL with the ALBs. and create a security rule to enforce forward secrecy (FS)
D. Change the ALB security policy to a policy that supports forward secrecy (FS)

Show answer and explanation ▾

Correct answer: D

Forward secrecy (FS) ensures that session keys are unique and ephemeral, so compromise of the long-term key does not expose past sessions. ALB security policies that support forward secrecy use cipher suites with ephemeral key exchange (ECDHE, DHE). Changing the ALB security policy to one supporting FS provides this protection at the TLS level without additional configuration or external services.

Why the other options are wrong:

A. TLS 1.2 alone does not guarantee forward secrecy; the cipher suite selection within the security policy determines FS support.
B. AWS KMS encrypts data at rest, not TLS session keys, and does not provide forward secrecy properties.
C. AWS WAF cannot enforce forward secrecy; this is a TLS cipher suite property managed at the ALB security policy level, not a WAF rule concern.

Question 27

A company has deployed a software-defined WAN (SD-WAN) solution to interconnect all of its offices. The company is migrating workloads to AWS and needs to extend its SD- WAN solution to support connectivity to these workloads. A network engineer plans to deploy AWS Transit Gateway Connect and two SD-WAN virtual appliances to provide this connectivity. According to company policies, only a single SD-WAN virtual appliance can handle traffic from AWS workloads at a given time. How should the network engineer configure routing to meet these requirements?

A. Add a static default route in the transit gateway route table to point to the secondary SD-WAN virtual appliance. Add routes that are more specific to point to the primary SD-WAN virtual appliance.
B. Configure the BGP community tag 7224:7300 on the primary SD-WAN virtual appliance for BGP routes toward the transit gateway.
C. Configure the AS_PATH prepend attribute on the secondary SD-WAN virtual appliance for BGP routes toward the transit gateway.
D. Disable equal-cost multi-path (ECMP) routing on the transit gateway for Transit Gateway Connect.

Show answer and explanation ▾

Correct answer: C

To ensure only the primary SD-WAN appliance handles traffic while keeping the secondary as standby, configure AS_PATH prepend on the secondary appliance for BGP routes toward the transit gateway. AS_PATH prepend artificially lengthens the advertised path, making it less preferred by BGP. The primary appliance's routes remain shorter and are preferred, ensuring it handles all traffic while the secondary remains ready for failover.

Why the other options are wrong:

A. Using static routes with more specific destinations contradicts dynamic BGP routing and doesn't leverage both appliances' BGP capabilities.
B. BGP community tag 7224:7300 is used for transit gateway route table association controls, not for active-passive appliance selection.
D. Disabling ECMP would prevent load distribution but doesn't establish active-passive behavior; AS_PATH prepend is the standard BGP method for preference selection.

Question 28

A company is planning to deploy many software-defined WAN (SD-WAN) sites. The company is using AWS Transit Gateway and has deployed a transit gateway in the required AWS Region. A network engineer needs to deploy the SD-WAN hub virtual appliance into a VPC that is connected to the transit gateway. The solution must support at least 5 Gbps of throughput from the SD-WAN hub virtual appliance to other VPCs that are attached to the transit gateway. Which solution will meet these requirements?

A. Create a new VPC for the SD-WAN hub virtual appliance. Create two IPsec VPN connections between the SD-WAN hub virtual appliance and the transit gateway. Configure BGP over the IPsec VPN connections
B. Assign a new CIDR block to the transit gateway. Create a new VPC for the SD- WAN hub virtual appliance. Attach the new VPC to the transit gateway with a VPC attachment. Add a transit gateway Connect attachment. Create a Connect peer and specify the GRE and BGP parameters. Create a route in the appropriate VPC for the SD-WAN hub virtual appliance to route to the transit gateway.
C. Create a new VPC for the SD-WAN hub virtual appliance. Attach the new VPC to the transit gateway with a VPC attachment. Create two IPsec VPN connections between the SD-WAN hub virtual appliance and the transit gateway. Configure BGP over the IPsec VPN connections.
D. Assign a new CIDR block to the transit gateway. Create a new VPC for the SD- WAN hub virtual appliance. Attach the new VPC to the transit gateway with a VPC attachment. Add a transit gateway Connect attachment. Create a Connect peer and specify the VXLAN and BGP parameters. Create a route in the appropriate VPC for the SD-WAN hub virtual appliance to route to the transit gateway.

Show answer and explanation ▾

Correct answer: B

Assign a new CIDR block to the transit gateway. Create a new VPC for the SD-WAN hub virtual appliance. Attach the new VPC to the transit gateway with a VPC attachment. Add a transit gateway Connect attachment. Create a Connect peer and specify the GRE and BGP parameters. Create a route in the appropriate VPC for the SD-WAN hub virtual appliance to route to the transit gateway. Transit Gateway Connect attachments using GRE encapsulation with BGP provide superior throughput compared to IPsec VPN, easily supporting the 5 Gbps requirement. Create a VPC for the SD-WAN hub, attach it to the transit gateway as a standard VPC attachment, then add a Transit Gateway Connect attachment with a Connect peer configured for GRE and BGP. This combination provides high-throughput, low-latency connectivity suitable for SD-WAN hub deployments while leveraging AWS native transit gateway capabilities.

Why the other options are wrong:

A. IPsec VPN connections have throughput limitations and would not reliably support 5 Gbps; two IPsec connections would still be constrained by IPsec overhead.
C. IPsec VPN is throughput-limited and not suitable for 5+ Gbps requirements; Connect with GRE is the preferred high-throughput option.
D. VXLAN is an overlay encapsulation for network segmentation/multi-tenancy, not for hub connectivity; GRE is the correct choice for SD-WAN hub transport.

Question 29

A company is deploying a new application on AWS. The application uses dynamic multicasting. The company has five VPCs that are all attached to a transit gateway Amazon EC2 instances in each VPC need to be able to register dynamically to receive a multicast transmission. How should a network engineer configure the AWS resources to meet these requirements?

A. Create a static source multicast domain within the transit gateway. Associate the VPCs and applicable subnets with the multicast domain. Register the multicast senders' network interface with the multicast domain. Adjust the network ACLs to allow UDP traffic from the source to all receivers and to allow UDP traffic that is sent to the multicast group address.
B. Create a static source multicast domain within the transit gateway. Associate the VPCs and applicable subnets with the multicast domain. Register the multicast senders' network interface with the multicast domain. Adjust the network ACLs to allow TCP traffic from the source to all receivers and to allow TCP traffic that is sent to the multicast group address.
C. Create an Internet Group Management Protocol (IGMP) multicast domain within the transit gateway. Associate the VPCs and applicable subnets with the multicast domain. Register the multicast senders' network interface with the multicast domain. Adjust the network ACLs to allow UDP traffic from the source to all receivers and to allow UDP traffic that is sent to the multicast group address.
D. Create an Internet Group Management Protocol (IGMP) multicast domain within the transit gateway. Associate the VPCs and applicable subnets with the multicast domain. Register the multicast senders' network interface with the multicast domain. Adjust the network ACLs to allow TCP traffic from the source to all receivers and to allow TCP traffic that is sent to the multicast group address.

Show answer and explanation ▾

Correct answer: C

Dynamic multicast registration requires Internet Group Management Protocol (IGMP) to allow EC2 instances to dynamically join multicast groups. Create an IGMP multicast domain within the transit gateway, associate the participating VPCs and subnets, and register multicast senders' network interfaces. Multicast transmission uses UDP, so allow UDP traffic to and from the multicast group address in network ACLs. IGMP enables the dynamic group membership required for this application.

Why the other options are wrong:

A. Static source multicast domains do not support dynamic registration; IGMP is required for instances to dynamically join groups.
B. Multicast uses UDP, not TCP; TCP would not work for multicast transmissions.
D. Static multicast domains cannot support dynamic registration, and TCP is incorrect for multicast traffic.

Question 30

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster. The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs. Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway. Peer each VPC to the transit gateway. Use zonal DNS names for the NLB in the services VPCs to minimize crossAZ traffic from the ingress VPC to the services VPCs.
B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC. Each PrivateLink endpoint will point to the zonal DNS entry of the NLB in the services VPCs.
C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs. Use zonal DNS names for the NLB in the services VPCs to minimize cross-AZ traffic from the ingress VPC to the services VPCs.
D. Create a transit gateway. Peer each VPC to the transit gateway. Turn off cross-AZ load balancing on the transit gateway. Use Regional DNS names for the NLB in the services VPCs.

Show answer and explanation ▾

Correct answer: C

VPC peering connections have the lowest data transfer costs between VPCs, with no per- hour charges and lower per-GB data transfer rates compared to transit gateway or PrivateLink solutions. Using zonal DNS names on the NLB in services VPCs ensures that traffic routes to the closest availability zone, minimizing cross-AZ data transfer costs. With 10+ TB monthly traffic, this approach provides the most cost-effective solution without additional per-connection or per-endpoint fees.

Why the other options are wrong:

A. Transit gateways charge per-hour attachment fees and per-GB processing charges, making them more expensive than VPC peering for simple one-to-many connectivity patterns.
B. PrivateLink endpoints incur hourly charges per endpoint and per-GB data processing fees, resulting in higher costs than VPC peering for high-volume data transfer scenarios.
D. Transit gateways with cross-AZ load balancing disabled still incur per-hour and per- GB charges that exceed VPC peering costs, and disabling cross-AZ balancing can reduce availability.

Question 31

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic. Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic. What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC.
B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC.
C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VPC.
D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs.

Show answer and explanation ▾

Correct answer: B

When stateful security appliances inspect east-west traffic through a transit gateway in separate subnets, appliance mode must be enabled on the transit gateway attachment to the shared services VPC. Without appliance mode enabled, the transit gateway cannot properly handle the asymmetric routing required for stateful inspection, causing traffic from different availability zones to be dropped. Appliance mode ensures that return traffic from the appliance follows the same path it arrived, which is critical for stateful firewalls.

Why the other options are wrong:

A. Having appliances and transit gateway attachments in separate subnets is actually the correct design pattern for appliance mode operation.
C. Deploying appliances and attachments in the same subnet would create network conflicts and is incorrect; they should be in separate subnets.
D. Appliance mode on application VPC attachments is not the issue; the problem is the missing appliance mode configuration on the shared services VPC attachment where the stateful appliances reside.

Question 32

A company has hundreds of Amazon EC2 instances that are running in two production VPCs across all Availability Zones in the us-east-1 Region. The production VPCs are named VPC A and VPC B. A new security regulation requires all traffic between production VPCs to be inspected before the traffic is routed to its final destination. The company deploys a new shared VPC that contains a stateful firewall appliance and a transit gateway with a VPC attachment across all VPCs to route traffic between VPC A and VPC B through the firewall appliance for inspection. During testing, the company notices that the transit gateway is dropping the traffic whenever the traffic is between two Availability Zones. What should a network engineer do to fix this issue with the LEAST management overhead?

A. In the shared VPC, replace the VPC attachment with a VPN attachment. Create a VPN tunnel between the transit gateway and the firewall appliance. Configure BGP.
B. Enable transit gateway appliance mode on the VPC attachment in VPC A and VPC B.
C. Enable transit gateway appliance mode on the VPC attachment in the shared VPC.
D. In the shared VPC, configure one VPC peering connection to VPC A and another VPC peering connection to VPC B.

Show answer and explanation ▾

Correct answer: C

Appliance mode must be enabled on the VPC attachment in the shared VPC (where the firewall appliance is located) to properly handle stateful inspection of traffic between availability zones. Appliance mode ensures that the transit gateway sends traffic to the firewall appliance and that return traffic follows the correct asymmetric path back through the appliance. This is the minimal configuration change needed to fix the cross-AZ traffic dropping issue with the least management overhead compared to replacing attachments or configuring VPN tunnels.

Why the other options are wrong:

A. Replacing VPC attachments with VPN attachments and configuring BGP introduces unnecessary complexity and higher overhead without addressing the fundamental appliance mode requirement.
B. Enabling appliance mode on attachments in VPC A and VPC B is incorrect; appliance mode must be enabled on the shared VPC attachment where the stateful firewall appliance is deployed.
D. Using VPC peering connections would bypass the transit gateway and firewall entirely, defeating the purpose of centralized traffic inspection and violating the security requirement.

Question 33

A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application Load Balancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group. A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection. Which solution will meet these requirements?

A. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT traffic on port 443. Publish the flow log records to a log group in Amazon CloudWatch Logs. Create a CloudWatch Logs metric filter for the log group for rejected traffic. Create an alarm to notify the network engineer.
B. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all traffic on port 443. Publish the flow log records to a log group in Amazon CloudWatch Logs. Create a CloudWatch Logs metric filter for the log group for all traffic. Create an alarm to notify the network engineer
C. Create a VPC Reachability Analyzer path on port 443. Specify the security group as the source. Specify the EC2 instances as the destination. Create an Amazon Simple Notification Service (Amazon SNS) topic to notify the network engineer when a change to the security group affects the connection. Create an AWS Lambda function to start Reachability Analyzer and to publish a message to the SNS topic in case the analyses fail Create an Amazon EventBridge (Amazon CloudWatch Events) rule to invoke the Lambda function when a change to the security group occurs.
D. Create a VPC Reachability Analyzer path on port 443. Specify the internet gateway of the VPC as the source. Specify the EC2 instances as the destination. Create an Amazon Simple Notification Service (Amazon SNS) topic to notify the network engineer when a change to the security group affects the connection. Create an AWS Lambda function to start Reachability Analyzer and to publish a message to the SNS topic in case the analyses fail. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to invoke the Lambda function when a change to the security group occurs.

Show answer and explanation ▾

Correct answer: D

VPC Reachability Analyzer with the internet gateway as the source and EC2 instances as the destination simulates traffic from the public internet to verify connectivity on port 443. Using EventBridge to trigger a Lambda function when security group changes occur ensures automated testing after every change. The Lambda function runs the Reachability Analyzer test and publishes results to an SNS topic for notifications. This approach directly tests the exact connectivity path from public internet through the load balancer to the instances, matching the real-world scenario.

Why the other options are wrong:

A. VPC Flow Logs capturing REJECT traffic on port 443 only shows rejected traffic after it occurs but does not actively verify connectivity or provide proactive monitoring before an outage impacts users.
B. VPC Flow Logs capturing all traffic on port 443 generates excessive logging data without actively verifying reachability, and metric filters on flow logs are reactive rather than proactive.
C. Using a security group as the source for Reachability Analyzer is not valid; the source should be the internet gateway to accurately simulate public internet traffic reaching the application.

Question 34

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured. The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications. Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format. Create a filter to gather flow logs only from the EKS nodes. Include the srcaddr field and the dstaddr field in the flow logs.
B. Create VPC flow logs in a custom format. Set the EKS nodes as the resource Include the pkt-srcaddr field and the pkt-dstaddr field in the flow logs.
C. Create VPC flow logs in a custom format. Set the application subnets as resources. Include the pkt-srcaddr field and the pkt-dstaddr field in the flow logs.
D. Create VPC flow logs in a custom format. Create a filter to gather flow logs only from the EKS nodes. Include the pkt-srcaddr field and the pkt-dstaddr field in the flow logs.

Show answer and explanation ▾

Correct answer: C

Create VPC flow logs in a custom format. Set the application subnets as resources. Include the pkt-srcaddr field and the pkt- dstaddr field in the flow logs. Creating VPC flow logs in custom format for the application subnets with pkt-srcaddr and pkt-dstaddr fields captures actual pod IP addresses (not just node IPs) while limiting logs to only the two relevant subnets. The pkt-srcaddr and pkt-dstaddr fields show packet-level source and destination addresses, which for pods represent the actual pod IPs. Setting the subnets as resources avoids capturing unnecessary logs from other parts of the VPC, minimizing operational overhead while providing the pod-to-service communication visibility the security team needs.

Why the other options are wrong:

A. Using srcaddr and dstaddr fields captures only the node IPs, not the pod IPs, making it impossible to determine which specific pods are communicating with which services.
B. Filtering only EKS nodes still captures node-level addresses rather than pod-level addresses; pkt-srcaddr/pkt-dstaddr on nodes would still show node IPs, not pod IPs.
D. Filtering only from EKS nodes combined with pkt-srcaddr/pkt-dstaddr would still primarily show node-level traffic; setting the subnets as resources is more efficient for pod-level analysis.

Question 35

A data analytics company has a 100-node high performance computing (HPC) cluster. The HPC cluster is for parallel data processing and is hosted in a VPC in the AWS Cloud. As part of the data processing workflow, the HPC cluster needs to perform several DNS queries to resolve and connect to Amazon RDS databases, Amazon S3 buckets, and on-premises data stores that are accessible through AWS Direct Connect. The HPC cluster can increase in size by five to seven times during the company's peak event at the end of the year. The company is using two Amazon EC2 instances as primary DNS servers for the VPC. The EC2 instances are configured to forward queries to the default VPC resolver for Amazon Route 53 hosted domains and to the on-premises DNS servers for other on- premises hosted domain names. The company notices job failures and finds that DNS queries from the HPC cluster nodes failed when the nodes tried to resolve RDS and S3 bucket endpoints. Which architectural change should a network engineer implement to provide the DNS service in the MOST scalable way?

A. Scale out the DNS service by adding two additional EC2 instances in the VPC. Reconfigure half of the HPC cluster nodes to use these new DNS servers. Plan to scale out by adding additional EC2 instance-based DNS servers in the future as the HPC cluster size grows.
B. Scale up the existing EC2 instances that the company is using as DNS servers. Change the instance size to the largest possible instance size to accommodate the current DNS load and the anticipated load in the future.
C. Create Route 53 Resolver outbound endpoints. Create Route 53 Resolver rules to forward queries to on-premises DNS servers for on premises hosted domain names. Reconfigure the HPC cluster nodes to use the default VPC resolver instead of the EC2 instance-based DNS servers. Terminate the EC2 instances.
D. Create Route 53 Resolver inbound endpoints. Create rules on the on-premises DNS servers to forward queries to the default VPC resolver. Reconfigure the HPC cluster nodes to forward all DNS queries to the on-premises DNS servers. Terminate the EC2 instances.

Show answer and explanation ▾

Correct answer: C

Route 53 Resolver provides a fully managed, auto-scaling DNS solution that eliminates the need to manage EC2-based DNS servers. Creating Route 53 Resolver outbound endpoints allows forwarding of on-premises domain queries to on-premises DNS servers while leveraging the default VPC resolver for AWS services. This approach scales automatically to handle the 5-7x cluster growth without additional configuration or capacity planning, eliminating bottlenecks caused by the limited capacity of two EC2 instances. The default VPC resolver efficiently handles RDS and S3 endpoint resolution.

Why the other options are wrong:

A. Adding more EC2 instances increases management overhead and still requires future scaling planning; this approach doesn't scale automatically and remains a manual, labor-intensive solution.
B. Scaling up to the largest instance size eventually reaches capacity limits and doesn't address the architectural limitation of EC2-based DNS; this doesn't support the 5-7x growth factor.
D. Creating inbound endpoints and reconfiguring on-premises servers adds complexity and still relies on on-premises DNS infrastructure for AWS service resolution, which is inefficient and doesn't leverage managed services.

Question 36

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway. The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage. Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100. Set the BGP community tag for all prefixes from the failover data center to 7224:7300
B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300. Set the BGP community tag for all prefixes from the failover data center to 7224:7100
C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300. Set the BGP community tag for all prefixes from the failover data center to 7224:9100
D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100. Set the BGP community tag for all prefixes from the failover data center to 7224:9300

Show answer and explanation ▾

Correct answer: B

In AWS Direct Connect, BGP community tag 7224:7300 is used to indicate lower preference (higher cost) for failover prefixes, while 7224:7100 is used for higher preference prefixes. By setting the primary data center prefixes to 7224:7300 and the failover data center prefixes to 7224:7100, AWS will prefer the failover path during normal operation and only use the primary path on failover. This inverted configuration ensures traffic routes to the primary data center first, with automatic failover to the secondary data center during outages.

Why the other options are wrong:

A. These community tags are reversed; this configuration would route traffic to the failover data center first instead of the primary data center.
C. The community tag 7224:9300 and 7224:9100 are not standard AWS Direct Connect BGP communities for primary/failover designation; these tags do not provide the required preference signaling.
D. These community tags are reversed compared to the correct configuration; this would result in traffic preferring the failover data center instead of the primary data center.

Question 37

A real estate company is building an internal application so that real estate agents can upload photos and videos of various properties. The application will store these photos and videos in an Amazon S3 bucket as objects and will use Amazon DynamoDB to store corresponding metadata. The S3 bucket will be configured to publish all PUT events for new object uploads to an Amazon Simple Queue Service (Amazon SQS) queue. A compute cluster of Amazon EC2 instances will poll the SQS queue to find out about newly uploaded objects. The cluster will retrieve new objects, perform proprietary image and video recognition and classification update metadata in DynamoDB and replace the objects with new watermarked objects. The company does not want public IP addresses on the EC2 instances. Which networking design solution will meet these requirements MOST cost-effectively as application usage increases?

A. Place the EC2 instances in a public subnet. Disable the Auto-assign Public IP option while launching the EC2 instances. Create an internet gateway. Attach the internet gateway to the VPC. In the public subnet's route table, add a default route that points to the internet gateway.
B. Place the EC2 instances in a private subnet. Create a NAT gateway in a public subnet in the same Availability Zone. Create an internet gateway. Attach the internet gateway to the VPC. In the public subnet's route table, add a default route that points to the internet gateway
C. Place the EC2 instances in a private subnet. Create an interface VPC endpoint for Amazon SQS. Create gateway VPC endpoints for Amazon S3 and DynamoDB.
D. Place the EC2 instances in a private subnet. Create a gateway VPC endpoint for Amazon SQS. Create interface VPC endpoints for Amazon S3 and DynamoDB.

Show answer and explanation ▾

Correct answer: C

Option C is the most cost-effective solution for private EC2 instances to access AWS services without public IP addresses. By using VPC endpoints (gateway endpoints for S3 and DynamoDB, interface endpoint for SQS), the company avoids data transfer costs associated with NAT gateways and internet gateways. Gateway endpoints are free and eliminate NAT gateway charges, while interface endpoints provide private connectivity to SQS. This design scales cost-effectively as usage increases since VPC endpoints don't incur per-GB data transfer fees like NAT gateways do.

Why the other options are wrong:

A. This places EC2 instances in a public subnet without public IPs, leaving them isolated from required AWS services without any connectivity mechanism.
B. While this provides connectivity, NAT gateway incurs significant charges ($0.045/hour plus $0.045/GB processed), making it cost-ineffective as usage increases.
D. This reverses the optimal endpoint types; gateway endpoints are free for S3 and DynamoDB, while interface endpoints for these services incur hourly and data processing charges.

Question 38

A company has an AWS Direct Connect connection between its on-premises data center in the United States (US) and workloads in the us-east-1 Region. The connection uses a transit VIF to connect the data center to a transit gateway in us-east-1. The company is opening a new office in Europe with a new on-premises data center in England. A Direct Connect connection will connect the new data center with some workloads that are running in a single VPC in the eu-west-2 Region. The company needs to connect the US data center and us-east-1 with the Europe data center and eu- west-2. A network engineer must establish full connectivity between the data centers and Regions with the lowest possible latency. How should the network engineer design the network architecture to meet these requirements?

A. Connect the VPC in eu-west-2 with the Europe data center by using a Direct Connect gateway and a private VIF. Associate the transit gateway in us-east-1 with the same Direct Connect gateway. Enable SiteLink for the transit VIF and the private VIF.
B. Connect the VPC in eu-west-2 to a new transit gateway. Connect the Europe data center to the new transit gateway by using a Direct Connect gateway and a new transit VIF. Associate the transit gateway in us-east-1 with the same Direct Connect gateway. Enable SiteLink for both transit VIFs. Peer the two transit gateways.
C. Connect the VPC in eu-west-2 to a new transit gateway. Connect the Europe data center to the new transit gateway by using a Direct Connect gateway and a new transit VIF. Create a new Direct Connect gateway. Associate the transit gateway in us-east-1 with the new Direct Connect gateway. Enable SiteLink for both transit VIFs. Peer the two transit gateways.
D. Connect the VPC in eu-west-2 with the Europe data center by using a Direct Connect gateway and a private VIF. Create a new Direct Connect gateway. Associate the transit gateway in us-east-1 with the new Direct Connect gateway. Enable SiteLink for the transit VIF and the private VIF.

Show answer and explanation ▾

Correct answer: B

Option B provides the lowest latency multi-region connectivity by using a single Direct Connect gateway with both transit gateways associated to it. Both US and Europe data centers connect via their respective transit VIFs to this single gateway, enabling direct data center-to-data center communication. SiteLink enables on-premises data centers to communicate directly without routing through AWS regions. The two transit gateways are peered to connect their respective VPCs, providing complete connectivity between all four components with optimal routing paths.

Why the other options are wrong:

A. This only creates connectivity between one data center pair and one VPC without establishing the necessary connection between the Europe data center and eu-west-2 VPC.
C. Creating two separate Direct Connect gateways prevents direct data center-to-data center communication and adds unnecessary complexity and latency.
D. This uses a private VIF instead of a transit VIF for the Europe connection, preventing proper integration with the transit gateway model and limiting multi-region connectivity.

Question 39

A network engineer needs to standardize a company's approach to centralizing and managing interface VPC endpoints for private communication with AWS services. The company uses AWS Transit Gateway for inter-VPC connectivity between AWS accounts through a hub-and-spoke model. The company's network services team must manage all Amazon Route 53 zones and interface endpoints within a shared services AWS account. The company wants to use this centralized model to provide AWS resources with access to AWS Key Management Service (AWS KMS) without sending traffic over the public internet. What should the network engineer do to meet these requirements?

A. In the shared services account, create an interface endpoint for AWS KMS. Modify the interface endpoint by disabling the private DNS name. Create a private hosted zone in the shared services account with an alias record that points to the interface endpoint. Associate the private hosted zone with the spoke VPCs in each AWS account.
B. In the shared services account, create an interface endpoint for AWS KMS. Modify the interface endpoint by disabling the private DNS name. Create a private hosted zone in each spoke AWS account with an alias record that points to the interface endpoint. Associate each private hosted zone with the shared services AWS account.
C. In each spoke AWS account, create an interface endpoint for AWS KMS. Modify each interface endpoint by disabling the private DNS name. Create a private hosted zone in each spoke AWS account with an alias record that points to each interface endpoint. Associate each private hosted zone with the shared services AWS account.
D. In each spoke AWS account, create an interface endpoint for AWS KMS. Modify each interface endpoint by disabling the private DNS name. Create a private hosted zone in the shared services account with an alias record that points to each interface endpoint. Associate the private hosted zone with the spoke VPCs in each AWS account.

Show answer and explanation ▾

Correct answer: A

Option A correctly implements a centralized VPC endpoint management model. By creating the KMS interface endpoint in the shared services account and disabling its private DNS name, then creating a private hosted zone in the shared services account with an alias record pointing to the endpoint, the company can associate this hosted zone with all spoke VPCs. This allows resources in spoke accounts to resolve KMS DNS names to the shared endpoint via the transit gateway, maintaining centralized management while avoiding internet traffic and unnecessary endpoints per account.

Why the other options are wrong:

B. Creating private hosted zones in each spoke account defeats the purpose of centralized management and doesn't support association models that allow spoke VPCs to resolve to the shared endpoint.
C. Creating endpoints in each spoke account eliminates the centralized management requirement and increases operational overhead and costs.
D. Creating endpoints in spoke accounts contradicts the requirement for centralized management in the shared services account.

Question 40

A company plans to deploy a two-tier web application to a new VPC in a single AWS Region. The company has configured the VPC with an internet gateway and four subnets. Two of the subnets are public and have default routes that point to the internet gateway. Two of the subnets are private and share a route table that does not have a default route. The application will run on a set of Amazon EC2 instances that will be deployed behind an external Application Load Balancer. The EC2 instances must not be directly accessible from the internet. The application will use an Amazon S3 bucket in the same Region to store data. The application will invoke S3 GET API operations and S3 PUT API operations from the EC2 instances. A network engineer must design a VPC architecture that minimizes data transfer cost. Which solution will meet these requirements?

A. Deploy the EC2 instances in the public subnets. Create an S3 interface endpoint in the VPC. Modify the application configuration to use the S3 endpoint-specific DNS hostname.
B. Deploy the EC2 instances in the private subnets. Create a NAT gateway in the VPC. Create default routes in the private subnets to the NAT gateway. Connect to Amazon S3 by using the NAT gateway.
C. Deploy the EC2 instances in the private subnets. Create an S3 gateway endpoint in the VPC. Specify die route table of the private subnets during endpoint creation to create routes to Amazon S3.
D. Deploy the EC2 instances in the private subnets. Create an S3 interface endpoint in the VPC. Modify the application configuration to use the S3 endpoint-specific DNS hostname.

Show answer and explanation ▾

Correct answer: C

Option C minimizes data transfer costs by deploying EC2 instances in private subnets and using an S3 gateway endpoint. Gateway endpoints are free and have no data transfer charges, eliminating the per-GB costs of NAT gateways ($0.045/GB). During creation, specifying the private subnet route table automatically adds routes to S3, enabling EC2 instances to access S3 GET and PUT operations without incurring NAT gateway charges. The ALB remains in public subnets, keeping instances non-directly-accessible from the internet.

Why the other options are wrong:

A. Placing EC2 instances in public subnets makes them directly accessible from the internet, violating the requirement that instances must not be directly accessible.
B. While this provides connectivity, NAT gateway incurs significant per-GB data transfer charges that increase with usage, making it cost-ineffective.
D. Interface endpoints for S3 incur hourly charges and per-GB data processing fees, making them far more expensive than gateway endpoints for this use case.

Question 41

A company has two AWS accounts one for Production and one for Connectivity. A network engineer needs to connect the Production account VPC to a transit gateway in the Connectivity account. The feature to auto accept shared attachments is not enabled on the transit gateway. Which set of steps should the network engineer follow in each AWS account to meet these requirements?

A. 1. In the Production account: Create a resource share in AWS Resource Access Manager for the transit gateway. Provide the Connectivity account ID. Enable the feature to allow external accounts 2. In the Connectivity account: Accept the resource. 3. In the Connectivity account: Create an attachment to the VPC subnets. 4. In the Production account: Accept the attachment. Associate a route table with the attachment.
B. 1. In the Production account: Create a resource share in AWS Resource Access Manager for the VPC subnets. Provide the Connectivity account ID. Enable the feature to allow external accounts. 2. In the Connectivity account: Accept the resource. 3. In the Production account: Create an attachment on the transit gateway to the VPC subnets. 4. In the Connectivity account: Accept the attachment. Associate a route table with the attachment.
C. 1. In the Connectivity account: Create a resource share in AWS Resource Access Manager for the VPC subnets. Provide the Production account ID. Enable the feature to allow external accounts. 2. In the Production account: Accept the resource. 3. In the Connectivity account: Create an attachment on the transit gateway to the VPC subnets. 4. In the Production account: Accept the attachment. Associate a route table with the attachment.
D. 1. In the Connectivity account: Create a resource share in AWS Resource Access Manager for the transit gateway. Provide the Production account ID Enable the feature to allow external accounts. 2. In the Production account: Accept the resource. 3. In the Production account: Create an attachment to the VPC subnets. 4. In the Connectivity account: Accept the attachment. Associate a route table with the attachment.

Show answer and explanation ▾

Correct answer: D

Option D correctly sequences the cross-account transit gateway attachment process. The Connectivity account (which owns the transit gateway) creates a Resource Access Manager share for the transit gateway and provides the Production account ID. The Production account accepts the resource, then creates the attachment to their VPC subnets, which generates a request. The Connectivity account accepts the attachment and associates a route table with it. This order respects AWS's cross-account attachment workflow where the account with the VPC initiates the attachment after accepting the transit gateway share.

Why the other options are wrong:

A. Sharing VPC subnets is not the correct resource to share; the transit gateway itself must be shared by the account that owns it.
B. This attempts to share VPC subnets from Production instead of sharing the transit gateway from Connectivity, and the attachment creation is backward.
C. The Connectivity account cannot create an attachment to Production VPC subnets; only the Production account can create attachments to its own resources.

Question 42

A company is running multiple workloads on Amazon EC2 instances in public subnets. In a recent incident, an attacker exploited an application vulnerability on one of the EC2 instances to gain access to the instance. The company fixed the application and launched a replacement EC2 instance that contains the updated application. The attacker used the compromised application to spread malware over the internet. The company became aware of the compromise through a notification from AWS. The company needs the ability to identify when an application that is deployed on an EC2 instance is spreading malware. Which solution will meet this requirement with the LEAST operational effort?

A. Use Amazon GuardDuty to analyze traffic patterns by inspecting DNS requests and VPC flow logs.
B. Use Amazon GuardDuty to deploy AWS managed decoy systems that are equipped with the most recent malware signatures.
C. Set up a Gateway Load Balancer. Run an intrusion detection system (IDS) appliance from AWS Marketplace on Amazon EC2 for traffic inspection.
D. Configure Amazon Inspector to perform deep packet inspection of outgoing traffic.

Show answer and explanation ▾

Correct answer: A

Option A requires the least operational effort because Amazon GuardDuty automatically analyzes VPC Flow Logs and DNS query logs to identify suspicious network activity and malware communication patterns without requiring manual configuration or management. GuardDuty uses machine learning and threat intelligence to detect command-and-control communication, data exfiltration, and cryptocurrency mining-all signs of malware spreading. This is a managed service requiring no infrastructure deployment or signature management.

Why the other options are wrong:

B. GuardDuty does not deploy decoy systems; this describes honeypot concepts that require manual infrastructure management.
C. Deploying and managing a Gateway Load Balancer with IDS appliances requires significant operational effort including patching, signature updates, and monitoring.
D. Amazon Inspector performs vulnerability assessments of EC2 instances, not real- time deep packet inspection of outgoing traffic for malware detection.

Question 43

A company deploys a new web application on Amazon EC2 instances. The application runs in private subnets in three Availability Zones behind an Application Load Balancer (ALB). Security auditors require encryption of all connections. The company uses Amazon Route 53 for DNS and uses AWS Certificate Manager (ACM) to automate SSL/TLS certificate provisioning. SSL/TLS connections are terminated on the ALB. The company tests the application with a single EC2 instance and does not observe any problems. However, after production deployment, users report that they can log in but that they cannot use the application. Every new web request restarts the login process. What should a network engineer do to resolve this issue?

A. Modify the ALB listener configuration. Edit the rule that forwards traffic to the target group. Change the rule to enable group-level stickiness. Set the duration to the maximum application session length.
B. Replace the ALB with a Network Load Balancer. Create a TLS listener. Create a new target group with the protocol type set to TLS Register the EC2 instances. Modify the target group configuration by enabling the stickiness attribute.
C. Modify the ALB target group configuration by enabling the stickiness attribute. Use an application-based cookie. Set the duration to the maximum application session length.
D. Remove the ALB. Create an Amazon Route 53 rule with a failover routing policy for the application name. Configure ACM to issue certificates for each EC2 instance.

Show answer and explanation ▾

Correct answer: C

The issue is that user sessions are being lost between requests because the ALB is distributing requests across multiple EC2 instances without maintaining session affinity. When SSL/TLS terminates at the ALB and routes to different backend instances, session data is lost unless sticky sessions are enabled. Option C correctly identifies enabling stickiness with an application-based cookie on the target group, which maintains session affinity by routing requests from the same client to the same backend instance for the duration of the session.

Why the other options are wrong:

A. ALB does not support group-level stickiness; stickiness is configured at the target group level with either duration-based or application-based cookies.
B. NLB is inappropriate here; the application requires application-layer load balancing and SSL/TLS termination which ALB provides. NLB operates at Layer 4 and is not suitable for this use case.
D. Removing the ALB and using Route 53 failover routing does not solve the session persistence problem and removes load balancing capabilities needed for the multi-AZ deployment.

Question 44

A company recently migrated its Amazon EC2 instances to VPC private subnets to satisfy a security compliance requirement. The EC2 instances now use a NAT gateway for internet access. After the migration, some long-running database queries from private EC2 instances to a publicly accessible third-party database no longer receive responses. The database query logs reveal that the queries successfully completed after 7 minutes but that the client EC2 instances never received the response. Which configuration change should a network engineer implement to resolve this issue?

A. Configure the NAT gateway timeout to allow connections for up to 600 seconds.
B. Enable enhanced networking on the client EC2 instances.
C. Enable TCP keepalive on the client EC2 instances with a value of less than 300 seconds.
D. Close idle TCP connections through the NAT gateway.

Show answer and explanation ▾

Correct answer: C

The issue is that NAT gateway connections have a default idle timeout of 350 seconds. When a long-running query takes 7 minutes, the connection becomes idle for more than 350 seconds, and the NAT gateway closes it before the response returns. By enabling TCP keepalive on the client EC2 instances with a value less than 300 seconds, keepalive packets are sent periodically to keep the connection active, preventing the NAT gateway from closing the idle connection during the long query execution.

Why the other options are wrong:

A. NAT gateway timeout cannot be configured to 600 seconds; the maximum configurable timeout is 350 seconds for idle connections, and this is not the root cause.
B. Enhanced networking improves throughput and packet rate performance but does not affect idle connection timeout behavior or keepalive mechanisms.
D. Closing idle TCP connections would exacerbate the problem, not solve it, as it would terminate connections even sooner.

Question 45

A company uses AWS Direct Connect to connect its corporate network to multiple VPCs in the same AWS account and the same AWS Region. Each VPC uses its own private VIF and its own virtual LAN on the Direct Connect connection. The company has grown and will soon surpass the limit of VPCs and private VIFs for each connection. What is the MOST scalable way to add VPCs with on-premises connectivity?

A. Provision a new Direct Connect connection to handle the additional VPCs. Use the new connection to connect additional VPCs.
B. Create virtual private gateways for each VPC that is over the service quota. Use AWS Site-to-Site VPN to connect the virtual private gateways to the corporate network.
C. Create a Direct Connect gateway, and add virtual private gateway associations to the VPCs. Configure a private VIF to connect to the corporate network.
D. Create a transit gateway, and attach the VPCs. Create a Direct Connect gateway, and associate it with the transit gateway. Create a transit VIF to the Direct Connect gateway.

Show answer and explanation ▾

Correct answer: D

A transit gateway combined with a Direct Connect gateway provides the most scalable solution. The transit gateway centralizes connectivity for multiple VPCs, and the Direct Connect gateway associates with the transit gateway rather than requiring individual private VIFs for each VPC. This approach eliminates the VPC and VIF per-connection limits and allows a single Direct Connect connection to serve many VPCs through the transit gateway, providing optimal scalability for growing infrastructure.

Why the other options are wrong:

A. Provisioning multiple Direct Connect connections does not address the core scalability issue of VIF limits per connection and creates unnecessary complexity and cost.
B. Using Site-to-Site VPN for additional VPCs is less scalable and performant than leveraging the existing Direct Connect connection with a transit gateway.
C. Using a Direct Connect gateway with individual virtual private gateway associations still requires a separate VIF and private gateway for each VPC, which does not scale beyond the original limits.

Question 46

A network engineer is designing a hybrid architecture that uses a 1 Gbps AWS Direct Connect connection between the company's data center and two AWS Regions: us-east-1 and eu-west-1. The VPCs in us-east-1 are connected by a transit gateway and need to access several on-premises databases. According to company policy, only one VPC in eu-west-1 can be connected to one on-premises server. The on-premises network segments the traffic between the databases and the server. How should the network engineer set up the Direct Connect connection to meet these requirements?

A. Create one hosted connection. Use a transit VIF to connect to the transit gateway in us-east-1. Use a private VIF to connect to the VPC in eu-west-1. Use one Direct. Connect gateway for both VIFs to route from the Direct Connect locations to the corresponding AWS Region along the path that has the lowest latency.
B. Create one hosted connection. Use a transit VIF to connect to the transit gateway in us-east-1. Use a private VIF to connect to the VPC in eu-west-1. Use two Direct Connect gateways, one for each VIF, to route from the Direct Connect locations to the corresponding AWS Region along the path that has the lowest latency.
C. Create one dedicated connection. Use a transit VIF to connect to the transit gateway in us-east-1. Use a private VIF to connect to the VPC in eu-west-1. Use one Direct Connect gateway for both VIFs to route from the Direct Connect locations to the corresponding AWS Region along the path that has the lowest latency.
D. Create one dedicated connection. Use a transit VIF to connect to the transit gateway in us-east-1. Use a private VIF to connect to the VPC in eu-west-1. Use two Direct Connect gateways, one for each VIF, to route from the Direct Connect locations to the corresponding AWS Region along the path that has the lowest latency.

Show answer and explanation ▾

Correct answer: D

This solution requires a dedicated connection (not hosted) to ensure reliability for the hybrid architecture. A transit VIF connects to the transit gateway in us-east-1 to serve all VPCs in that region, while a separate private VIF connects to the single VPC in eu-west-1 per company policy. Two separate Direct Connect gateways are necessary because they operate within a single region; one DX gateway in eu-west-1 handles the private VIF, and one in us-east-1 handles the transit VIF, allowing proper regional routing and traffic segmentation between the databases and on-premises server.

Why the other options are wrong:

A. A hosted connection lacks the reliability and performance guarantees needed for a hybrid architecture with strict segmentation requirements.
B. Using a hosted connection instead of dedicated connection reduces reliability; a single DX gateway cannot properly manage traffic segmentation between different regions and VIFs.
C. A dedicated connection is correct, but a single DX gateway cannot serve both regions; DX gateways are regional resources, requiring one per region.

Question 47

A company has deployed an application in a VPC that uses a NAT gateway for outbound traffic to the internet. A network engineer notices a large quantity of suspicious network traffic that is traveling from the VPC over the internet to IP addresses that are included on a deny list. The network engineer must implement a solution to determine which AWS resources are generating the suspicious traffic. The solution must minimize cost and administrative overhead. Which solution will meet these requirements?

A. Launch an Amazon EC2 instance in the VPC. Use Traffic Mirroring by specifying the NAT gateway as the source and the EC2 instance as the destination. Analyze the captured traffic by using open-source tools to identify the AWS resources that are generating the suspicious traffic.
B. Use VPC flow logs. Launch a security information and event management (SIEM) solution in the VPC. Configure the SIEM solution to ingest the VPC flow logs. Run queries on the SIEM solution to identify the AWS resources that are generating the suspicious traffic.
C. Use VPC flow logs. Publish the flow logs to a log group in Amazon CloudWatch Logs. Use CloudWatch Logs Insights to query the flow logs to identify the AWS resources that are generating the suspicious traffic.
D. Configure the VPC to stream the network traffic directly to an Amazon Kinesis data stream. Send the data from the Kinesis data stream to an Amazon Kinesis Data Firehose delivery stream to store the data in Amazon S3. Use Amazon Athena to query the data to identify the AWS resources that are generating the suspicious traffic.

Show answer and explanation ▾

Correct answer: C

VPC flow logs capture network traffic information including source/destination IPs and ports, which can identify which resources are communicating with the deny-listed IPs. Publishing logs to CloudWatch Logs and using CloudWatch Logs Insights provides a cost- effective, low-overhead solution with built-in querying capabilities. This approach requires minimal setup and administration while providing the necessary visibility to identify suspicious resources without deploying additional infrastructure.

Why the other options are wrong:

A. Traffic Mirroring cannot mirror from the NAT gateway; it requires EC2 instances as sources and adds infrastructure overhead with an instance-based analysis tool.
B. While SIEM solutions work, they require launching and managing a SIEM instance, adding significant cost and administrative overhead compared to native CloudWatch solutions.
D. Kinesis and Firehose add unnecessary complexity and cost for this use case; they are overkill for simple flow log analysis when CloudWatch Logs Insights provides sufficient querying capabilities.

Question 48

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is the origin in an Amazon CloudFront distribution. The company wants to implement a custom authentication system that will provide a token for its authenticated customers. The web application must ensure that the GET/POST requests come from authenticated customers before it delivers the content. A network engineer must design a solution that gives the web application the ability to identify authorized customers. What is the MOST operationally efficient solution that meets these requirements?

A. Use the ALB to inspect the authorized token inside the GET/POST request payload. Use an AWS Lambda function to insert a customized header to inform the web application of an authenticated customer request.
B. Integrate AWS WAF with the ALB to inspect the authorized token inside the GET/POST request payload. Configure the ALB listener to insert a customized header to inform the web application of an authenticated customer request.
C. Use an AWS Lambda@Edge function to inspect the authorized token inside the GET/POST request payload. Use the Lambda@Edge function also to insert a customized header to inform the web application of an authenticated customer request.
D. Set up an EC2 instance that has a third-party packet inspection tool to inspect the authorized token inside the GET/POST request payload. Configure the tool to insert a customized header to inform the web application of an authenticated customer request.

Show answer and explanation ▾

Correct answer: C

Lambda@Edge functions execute at CloudFront edge locations and can inspect request payloads for authentication tokens before requests reach the origin. This approach is operationally efficient because it enforces authentication at the edge, reducing unnecessary requests to the origin ALB and backend. The Lambda@Edge function can validate tokens and insert custom headers to communicate authentication status to the web application, providing a scalable, managed solution without additional infrastructure.

Why the other options are wrong:

A. ALB inspection requires requests to reach the origin, wasting bandwidth; Lambda functions cannot directly manipulate CloudFront requests without Lambda@Edge.
B. AWS WAF is designed for DDoS and malicious traffic protection, not custom token validation; it cannot easily insert custom headers based on token inspection.
D. A third-party packet inspection EC2 instance adds infrastructure overhead, management complexity, and operational burden compared to serverless Lambda@Edge.

Question 49

A company has created three VPCs: a production VPC, a nonproduction VPC, and a shared services VPC. The production VPC and the nonproduction VPC must each have communication with the shared services VPC. There must be no communication between the production VPC and the nonproduction VPC. A transit gateway is deployed to facilitate communication between VPCs. Which route table configurations on the transit gateway will meet these requirements?

A. Configure a route table with the production and nonproduction VPC attachments associated with propagated routes for only the shared services VPC. Create an additional route table with only the shared services VPC attachment associated with propagated routes from the production and nonproduction VPCs.
B. Configure a route table with the production and nonproduction VPC attachments associated with propagated routes for each VPC. Create an additional route table with only the shared services VPC attachment associated with propagated routes from each VPC.
C. Configure a route table with all the VPC attachments associated with propagated routes for only the shared services VPC. Create an additional route table with only the shared services VPC attachment associated with propagated routes from the production and nonproduction VPCs.
D. Configure a route table with the production and nonproduction VPC attachments associated with propagated routes disabled. Create an additional route table with only the shared services VPC attachment associated with propagated routes from the production and nonproduction VPCs.

Show answer and explanation ▾

Correct answer: A

To allow production and nonproduction VPCs to communicate only with shared services (not with each other), you need two separate route tables. The first route table should have both production and nonproduction VPC attachments with propagated routes limited to only the shared services VPC. The second route table should have only the shared services VPC attachment with propagated routes from both production and nonproduction VPCs. This ensures traffic can flow between each production/nonproduction VPC and shared services, but blocks direct communication between production and nonproduction VPCs.

Why the other options are wrong:

B. Associating both production and nonproduction attachments with propagated routes for each VPC would allow direct communication between them, violating the requirement.
C. Including all VPC attachments in a single route table with shared services propagation would still allow production-to-nonproduction communication through the shared services attachment.
D. Disabling propagated routes would prevent any communication through the transit gateway entirely.

Question 50

A company is using an AWS Site-to-Site VPN connection from the company's on- premises data center to a virtual private gateway in the AWS Cloud Because of congestion, the company is experiencing availability and performance issues as traffic travels across the internet before the traffic reaches AWS. A network engineer must reduce these issues for the connection as quickly as possible with minimum administration effort. Which solution will meet these requirements?

A. Edit the existing Site-to-Site VPN connection by enabling acceleration. Stop and start the VPN service on the customer gateway for the new setting to take effect.
B. Configure a transit gateway in the same AWS Region as the existing virtual private gateway. Create a new accelerated Site-to-Site VPN connection. Connect the new connection to the transit gateway by using a VPN attachment. Update the customer gateway device to use the new Site to Site VPN connection. Delete the existing Site-to-Site VPN connection
C. Create a new accelerated Site-to-Site VPN connection. Connect the new Site-to- Site VPN connection to the existing virtual private gateway. Update the customer gateway device to use the new Site-to-Site VPN connection. Delete the existing Site- to-Site VPN connection.
D. Create a new AWS Direct Connect connection with a private VIF between the on- premises data center and the AWS Cloud. Update the customer gateway device to use the new Direct Connect connection. Delete the existing Site-to-Site VPN connection.

Show answer and explanation ▾

Correct answer: C

Create a new accelerated Site-to-Site VPN connection. Connect the new Site-to-Site VPN connection to the existing virtual private gateway. Update the customer gateway device to use the new Site-to-Site VPN connection. Delete the existing Site-to-Site VPN connection. Accelerated Site-to-Site VPN can be enabled on a new VPN connection to improve performance by using AWS Global Accelerator infrastructure. The quickest solution with minimum administration is to create a new accelerated Site-to-Site VPN connection directly with the existing virtual private gateway, then update the customer gateway device to use the new connection and delete the old one. This avoids unnecessary complexity of adding a transit gateway while still achieving the performance improvement needed.

Why the other options are wrong:

A. Site-to-Site VPN connections cannot be modified to enable acceleration on existing connections; you must create a new connection.
B. While adding a transit gateway works, it introduces unnecessary operational overhead when acceleration can be achieved by simply creating a new accelerated VPN connection directly to the existing virtual private gateway.
D. AWS Direct Connect requires significantly more time to provision and setup than VPN acceleration, which can be deployed quickly to address the immediate congestion issue.

Get the complete ANS-C01 bank

These 50 questions are roughly 22% of the bank. The full pack has 296 real ANS-C01 questions, each with the same depth of explanation, plus a questions-only PDF for timed practice and free updates forever.

View the full AWS ANS-C01 question bank →

Back to blog

ANS-C01 practice questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 26

Question 27

Question 28

Question 29

Question 30

Question 31

Question 32

Question 33

Question 34

Question 35

Question 36

Question 37

Question 38

Question 39

Question 40

Question 41

Question 42

Question 43

Question 44

Question 45

Question 46

Question 47

Question 48

Question 49

Question 50

Get the complete ANS-C01 bank

Related exams